docs: D6-D9 — HEALTHCHECK, env regression test, new docs, archive spec

Add Docker HEALTHCHECK and mail-path /healthz liveness; env-doc regression
test; architecture.md and development.md; product.md and expanded security.md;
retire live specification.md to docs/archive/.

Co-Authored-By: Claude <claude-opus-5-thinking-high@noreply@anthropic.com>

internal/health/health_test.go

@@ -163,3 +163,28 @@ func writeCert(t *testing.T, path, cn string, validFor time.Duration) {
 		t.Fatal(err)
 	}
 }
+
+func TestLivenessFromParsedProcesses(t *testing.T) {
+	allRunning := `opendkim                         RUNNING   pid 21, uptime 0:04:10
+panel                            RUNNING   pid 22, uptime 0:04:09
+postfix                          RUNNING   pid 23, uptime 0:04:08
+postfix-reload                   STOPPED   Not started
+`
+	procs := parseProcesses(allRunning)
+	for _, p := range procs {
+		if mailPathPrograms[p.Name] && p.Status != StatusOK {
+			t.Fatalf("%s should be ok for liveness, got %q", p.Name, p.Status)
+		}
+	}
+
+	postfixDead := `opendkim                         RUNNING   pid 21, uptime 0:04:10
+panel                            RUNNING   pid 22, uptime 0:04:09
+postfix                          FATAL     Exited too quickly
+`
+	procs = parseProcesses(postfixDead)
+	for _, p := range procs {
+		if p.Name == "postfix" && p.Status == StatusOK {
+			t.Fatal("postfix FATAL should not grade as OK")
+		}
+	}
+}

internal/health/liveness.go

@@ -0,0 +1,46 @@
+package health
+
+import (
+	"fmt"
+	"strings"
+)
+
+// mailPathPrograms are the supervised processes whose absence means the
+// container should not report healthy to orchestrators.
+var mailPathPrograms = map[string]bool{
+	"opendkim": true,
+	"panel":    true,
+	"postfix":  true,
+}
+
+// Liveness reports whether the mail path is healthy enough for container
+// probes. It requires opendkim, panel, and postfix to be RUNNING under
+// supervisord.
+func Liveness() error {
+	procs, err := Processes()
+	if err != nil {
+		return err
+	}
+
+	seen := make(map[string]Status, len(mailPathPrograms))
+	for _, p := range procs {
+		if mailPathPrograms[p.Name] {
+			seen[p.Name] = p.Status
+		}
+	}
+
+	var unhealthy []string
+	for name := range mailPathPrograms {
+		switch seen[name] {
+		case StatusOK:
+		case StatusUnknown:
+			unhealthy = append(unhealthy, name+": missing")
+		default:
+			unhealthy = append(unhealthy, fmt.Sprintf("%s: %s", name, seen[name]))
+		}
+	}
+	if len(unhealthy) > 0 {
+		return fmt.Errorf("unhealthy: %s", strings.Join(unhealthy, ", "))
+	}
+	return nil
+}

internal/web/web.go

@@ -14,6 +14,7 @@ import (
 	"codeberg.org/mix/selfpost/internal/app"
 	"codeberg.org/mix/selfpost/internal/dnscheck"
 	"codeberg.org/mix/selfpost/internal/domain"
+	"codeberg.org/mix/selfpost/internal/health"
 	"codeberg.org/mix/selfpost/internal/store"
 )
 
@@ -207,6 +208,10 @@ func redirectToStatus(w http.ResponseWriter, r *http.Request) {
 
 func handleHealth(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	if err := health.Liveness(); err != nil {
+		http.Error(w, "unhealthy\n", http.StatusServiceUnavailable)
+		return
+	}
 	w.WriteHeader(http.StatusOK)
 	_, _ = w.Write([]byte("ok\n"))
 }