health: sockets dialled, the certificate Postfix serves, "deferred" only for the queue

Audit 2026-10-12, stage 2c, "Health says what is served"; the pages of
ea8b6bf's mockup.

Sockets (A-38). A unix socket's file outlives a killed OpenDKIM or panel
and refuses every connect() (unix(7)); Health said "Listening" from a
stat. CheckSocket and CheckMilter's unix case now dial: refused is
"Nothing listens on the ... socket: the program that made it has
stopped", EACCES is unknown (the panel may not connect), anything else
"does not answer". The probe closes before a byte, which no milter logs:
libmilter takes the EOF as SMFIC_EOF without a line (sendmail
8.17.1.9-2+deb12u2, the image's libmilter1.0.1, libmilter/comm.c
mi_rd_cmd(), engine.c mi_engine() - its source is now in dev/upstream),
OpenDKIM's mlfi_close() has no connection to free, go-milter v0.4.1
returns quietly on io.EOF (session.go, HandleMilterCommands()). The page
polls every 5 s while in view, so this mattered.

Certificate (A-65). Postfix serves build/postfix-config.sh's copy,
refreshed by cert-reload every TLS_RELOAD_INTERVAL_SECONDS. The panel now
reads smtpd_tls_cert_file from postconf -h at its start (as the retry
policy) and TLS_RELOAD_INTERVAL_SECONDS; CheckServedCertificate checks the
served copy and, when the mounted file differs byte for byte (cert-reload's
own cmp -s), names it as Renewal: its expiry and mtime, two facts on the
card. Waiting is fine for the interval: a nearing expiry of the served one
is then no warning (an expiry still an error); past interval + 1 h it is a
warning pointing at cert-reload's lines. The notifier sends no expiry
notice while a renewal waits on time.

Wording (D-P1, D-P3, and the same for the spam filter): Sender check
note, help topics sender-check, upstream, filter, certificate - word for
word as in the mockup; the filter row's detail too.

Tests: stale socket file (Linux) refused for CheckSocket and CheckMilter;
CheckServedCertificate (same, waiting, late, expired + waiting, no served
path); intervalText; the card's facts; the notifier quiet while a renewal
waits, speaking once it is late. Stand (2026-10-15, make e2e, exit 0):
new health_shows_what_is_served - the three sockets dialled ok by the
panel's user; a certificate mounted without its key is refused by
cert-reload ("do not belong together") and the card shows the served
expiry, "Renewal expires" with the mounted one's, "Renewal mounted", and
"Postfix still serves the certificate above."; a matching pair is then
served again. go vet and go test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers.go

@@ -3,6 +3,7 @@ package handlers
 
 import (
 	"log"
+	"time"
 
 	"github.com/mixeme/selfpost/internal/app"
 	"github.com/mixeme/selfpost/internal/dmarc"
@@ -26,6 +27,8 @@ type Config struct {
 	DeployRoot        string
 	Version           string
 	TLSCertFile       string
+	TLSServedCertFile string
+	TLSReloadInterval time.Duration
 	OpenDKIMSocket    string
 	JournalSocket     string
 	SenderSocket      string

internal/web/handlers/handlers_health_page_test.go

@@ -150,6 +150,31 @@ func TestHealthPageStatesOfTheOtherChecks(t *testing.T) {
 	}
 }
 
+// The certificate card names a renewal Postfix has not taken up yet: its
+// expiry and when it was mounted, beside the served one's (A-65).
+func TestHealthPageNamesARenewalWaiting(t *testing.T) {
+	h, _ := settingsServer(t)
+	c := healthReading()
+	cert := c["Cert"].(health.Certificate)
+	cert.Renewal = &health.Renewal{
+		NotAfter: time.Date(2027, 1, 31, 8, 2, 0, 0, time.UTC),
+		Mounted:  time.Date(2026, 10, 15, 3, 12, 0, 0, time.UTC),
+	}
+	cert.Detail = "Postfix still serves the certificate above. A renewed one is waiting in the mounted file."
+	c["Cert"] = cert
+	out := renderHealth(t, h, c, "")
+	for _, want := range []string{
+		"<dt>Expires</dt>", "2026-11-08 09:14 UTC",
+		"<dt>Renewal expires</dt>", "2027-01-31 08:02 UTC",
+		"<dt>Renewal mounted</dt>", "2026-10-15 03:12 UTC",
+		"Postfix still serves the certificate above.",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("health page is missing %q", want)
+		}
+	}
+}
+
 // The fragment is what the page holds in its polled rows, read again.
 func TestHealthFragmentCarriesTheSameRows(t *testing.T) {
 	h, _ := settingsServer(t)

internal/web/handlers/handlers_status.go

@@ -207,6 +207,11 @@ func healthPage(m view.Meta, c map[string]any, flash string) *view.Health {
 	if cert.Subject != "" {
 		page.CertFacts = append(page.CertFacts, view.Fact{Label: "Names", Value: view.Plain(cert.Subject), Mono: true})
 	}
+	if r := cert.Renewal; r != nil {
+		page.CertFacts = append(page.CertFacts,
+			view.Fact{Label: "Renewal expires", Value: view.Plain(r.NotAfter.UTC().Format("2006-01-02 15:04 UTC")), Mono: true},
+			view.Fact{Label: "Renewal mounted", Value: view.Plain(r.Mounted.UTC().Format("2006-01-02 15:04 UTC")), Mono: true})
+	}
 	page.CertDetail, page.CertProblem = cert.Detail, cert.Status != health.StatusOK
 
 	page.Sockets.End = view.Verdict(string(c["SocketStatus"].(health.Status)))
@@ -430,7 +435,7 @@ func (h *Handlers) healthChecks() map[string]any {
 		queueStatus = health.StatusWarn
 	}
 
-	cert := health.CheckCertificate(h.cfg.TLSCertFile)
+	cert := health.CheckServedCertificate(h.cfg.TLSServedCertFile, h.cfg.TLSCertFile, h.cfg.TLSReloadInterval, time.Now())
 	sockets := []health.Socket{
 		health.CheckSocket("OpenDKIM", h.cfg.OpenDKIMSocket, true),
 		health.CheckSocket("sender-check", h.cfg.SenderSocket, true),

internal/web/view/health.go

@@ -175,7 +175,7 @@ func (h *Health) WithSenderCheck(rows []SenderCheckRow, since, status string) *H
 	h.SenderCheck.End = Verdict(status)
 	h.SenderRows = rows
 	h.SenderNote = Rich("The panel holds each message's ", Code("From:"),
-		" against the application that sends it. While the panel does not answer, Postfix defers mail instead of accepting it unchecked. Time is counted only while Postfix itself was running; ≈ marks a period with a start at which that could not be asked, and its time is at most what is shown.")
+		" against the application that sends it. While the panel does not answer, Postfix answers the sending application with a temporary error instead of accepting mail unchecked, and the application tries again later. Time is counted only while Postfix itself was running; ≈ marks a period with a start at which that could not be asked, and its time is at most what is shown.")
 	if since != "" {
 		h.SenderNote = append(h.SenderNote, Rich(" Counted since ", Mono(since), ".")...)
 	}

internal/web/view/help.go

@@ -148,7 +148,7 @@ var overviewTopics = []HelpTopic{
 			" shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total."),
 	}},
 	{ID: HelpCertificate, Title: "TLS certificate", Body: []Text{
-		Plain("The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. It warns 14 days before expiry and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect."),
+		Plain("The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect."),
 	}},
 	{ID: HelpRDNS, Title: "Hostname and reverse DNS", Body: []Text{
 		Rich("The hostname (", Code("SELFPOST_HOSTNAME"), ") must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone."),
@@ -171,7 +171,7 @@ var outboundTopics = []HelpTopic{
 			Code("From:"), " - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with ",
 			Code("550 5.7.1"), ". It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from getting mail signed with another domain's key.",
 			Br(), Br(),
-			"The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were deferred in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message deferred in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own."),
+			"The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own."),
 	}},
 	{ID: HelpLimits, Title: "Rate limits", Body: []Text{
 		Rich("Level 1 is a per-IP ceiling set in ", Code(".env"), ". Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's."),
@@ -196,14 +196,14 @@ var inboundTopics = []HelpTopic{
 		Rich("An optional backup-MX or forwarder, switched on in the server's ", Code(".env"), "; the Inbound menu exists only then. Postfix accepts mail on port 25 for the listed domains only and hands each message on to that domain's upstream; there are no mailboxes. For each domain publish the MX record its page shows, and keep a primary MX the domain already has if this is a backup. The MX tag is green when at least one MX of the domain points at this server, and a domain accepts no mail until an upstream is saved on its page. Adding and deleting domains is for the global role."),
 	}},
 	{ID: HelpUpstream, Title: "Upstream", Body: []Text{
-		Plain("The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear, Required holds the mail until a TLS session is possible, Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail."),
+		Plain("The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it; Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail."),
 	}},
 	{ID: HelpRecipients, Title: "Valid recipients", Body: []Text{
 		Plain("Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream."),
 	}},
 	{ID: HelpFilter, Title: "Spam filter", Body: []Text{
 		Rich("The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's ", Code(".env"),
-			", and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or deferred, so the sending server tries again later, as the server's setting says; the box states which."),
+			", and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or refused with a temporary error, so the sending server tries again later, as the server's setting says; the box states which."),
 	}},
 	{ID: HelpInboundLog, Title: "Inbound log", Body: []Text{
 		Rich("One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: ",

internal/web/web.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/mixeme/selfpost/internal/app"
 	"github.com/mixeme/selfpost/internal/dmarc"
@@ -57,12 +58,16 @@ type Config struct {
 	// honoured, so the header can't be spoofed by anyone but a trusted proxy.
 	// Empty (the default) keeps rate-limiting keyed on RemoteAddr only.
 	TrustedProxyCIDRs []*net.IPNet
-	// TLSCertFile is the certificate Postfix serves on 465/587 (guide §
-	// Environment variables), read read-only by the status page to report how
-	// much validity is left.
-	TLSCertFile string
+	// TLSCertFile is the mounted certificate (guide § Environment variables);
+	// TLSServedCertFile is Postfix's copy of it, the one served on 465/587,
+	// and TLSReloadInterval how often that copy is refreshed. Health reads
+	// the served one and names the mounted one while they differ
+	// (health.CheckServedCertificate).
+	TLSCertFile       string
+	TLSServedCertFile string
+	TLSReloadInterval time.Duration
 	// OpenDKIMSocket and JournalSocket are the two milter sockets Postfix
-	// connects to. The status page stats them: the first is required for mail
+	// connects to. The status page dials them: the first is required for mail
 	// to leave at all (OpenDKIM runs with default_action=tempfail), the second
 	// only for the send log (the journal-milter fails open).
 	OpenDKIMSocket string
@@ -138,6 +143,8 @@ func New(st *store.Store, domains *domain.Service, apps *app.Service, inboundSvc
 		DeployRoot:                 cfg.DeployRoot,
 		Version:                    cfg.Version,
 		TLSCertFile:                cfg.TLSCertFile,
+		TLSServedCertFile:          cfg.TLSServedCertFile,
+		TLSReloadInterval:          cfg.TLSReloadInterval,
 		OpenDKIMSocket:             cfg.OpenDKIMSocket,
 		JournalSocket:              cfg.JournalSocket,
 		SenderSocket:               cfg.SenderSocket,