Phase 9: full backup/restore + domain export/import (spec 7.5, 11.6)
Full server backup (spec 7.5.A): internal/backup produces a tar.gz of all of /data — a consistent SQLite snapshot via VACUUM INTO, DKIM keys, sasldb2 and a version manifest; TLS certs (tls/) and the Postfix queue are excluded. Two equal paths: the panel button (POST /backup, no-store) and the selfpost-backup CLI via docker exec (spec 11.6). CheckRestore runs before store.Open: a manifest version mismatch refuses to boot with the image tag to use; a match consumes the manifest so it only guards the first post-restore boot. Restore is not a separate branch — Postfix/OpenDKIM regenerate from the restored SQLite as on any start. Domain export/import (spec 7.5.B): DomainExport carries the DKIM private key and each application's working password. SASL secrets are read from sasldb2 via db_dump (the userPassword property is plaintext) and, on import, re-keyed under the local realm with saslpasswd2 — so credentials keep working on an instance with a different hostname, with no DKIM DNS change. Import validates and rolls back atomically on any failure. db-util (db_dump) is now an explicit image dep. Verified on the server (selfpost:p9): gofmt/vet/test green; container e2e for cross-realm domain export/import (SMTP AUTH 235 under the new realm), CLI and panel backups, same-version restore, and version-mismatch refusal. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
@@ -1,6 +1,8 @@
|
||||
package domain
|
||||
|
||||
import (
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
@@ -87,6 +89,46 @@ func (o *OpenDKIM) RemoveKey(domainName string) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// ExportKey returns a domain's DKIM private key as PKCS#1 PEM, for carrying in a
|
||||
// domain export so the receiving instance signs with the same key and the DNS
|
||||
// TXT record never has to change (spec 7.5.B). It re-marshals the parsed key
|
||||
// rather than returning the raw file, so a malformed on-disk key is caught here.
|
||||
func (o *OpenDKIM) ExportKey(domainName, selector string) ([]byte, error) {
|
||||
if err := assertConfigSafe(domainName, selector); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
key, err := loadPrivateKeyPEM(o.keyPath(domainName, selector))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
block := &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}
|
||||
return pem.EncodeToMemory(block), nil
|
||||
}
|
||||
|
||||
// ImportKey writes an imported DKIM private key to disk for a domain (spec
|
||||
// 7.5.B). The PEM is parsed and re-marshalled through the same writer used for
|
||||
// generated keys, so only a well-formed PKCS#1 RSA key is ever stored. Unlike
|
||||
// EnsureKey it overwrites: an import (re-)creates the domain with exactly this
|
||||
// key, which is the whole point of keeping the published DNS record valid.
|
||||
func (o *OpenDKIM) ImportKey(domainName, selector string, pemKey []byte) error {
|
||||
if err := assertConfigSafe(domainName, selector); err != nil {
|
||||
return err
|
||||
}
|
||||
block, _ := pem.Decode(pemKey)
|
||||
if block == nil || block.Type != "RSA PRIVATE KEY" {
|
||||
return fmt.Errorf("import dkim key for %s: not a PKCS#1 RSA private key", domainName)
|
||||
}
|
||||
key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
|
||||
if err != nil {
|
||||
return fmt.Errorf("import dkim key for %s: %w", domainName, err)
|
||||
}
|
||||
path := o.keyPath(domainName, selector)
|
||||
if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
|
||||
return fmt.Errorf("create key dir: %w", err)
|
||||
}
|
||||
return writePrivateKeyPEM(path, key)
|
||||
}
|
||||
|
||||
// Record returns the published DKIM DNS record for a domain, recomputed from the
|
||||
// private key on disk (spec 7.2.10).
|
||||
func (o *OpenDKIM) Record(domainName, selector string) (DKIMRecord, error) {
|
||||
|
||||
@@ -18,6 +18,12 @@ type Applications interface {
|
||||
// Resync rebuilds smtpd_sender_login_maps from the remaining applications
|
||||
// and reloads Postfix.
|
||||
Resync() error
|
||||
// Secret returns an application's stored password, for a domain export
|
||||
// (spec 7.5.B).
|
||||
Secret(login string) (string, error)
|
||||
// ImportApplication re-creates an application (registry row + SASL account)
|
||||
// from a domain-export file, without rebuilding the sender map (spec 7.5.B).
|
||||
ImportApplication(domainID int64, login, mode string, addresses []string, password string) error
|
||||
}
|
||||
|
||||
// Service coordinates the places a sending domain lives: the SQLite registry,
|
||||
|
||||
@@ -0,0 +1,131 @@
|
||||
package domain
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"codeberg.org/mix/selfpost/internal/buildinfo"
|
||||
"codeberg.org/mix/selfpost/internal/store"
|
||||
)
|
||||
|
||||
// FormatDomainExport identifies a single-domain export file (spec 7.5.B).
|
||||
const FormatDomainExport = "selfpost-domain-export"
|
||||
|
||||
// DomainExport is the serialisable form of one sending domain, for moving it
|
||||
// between two independently running SelfPost instances (spec 7.5.B). It carries
|
||||
// the DKIM private key (so the published DNS record stays valid) and each
|
||||
// application's working password (so credentials transfer without regeneration).
|
||||
// The file is therefore as sensitive as a full backup and must be handled as a
|
||||
// secret.
|
||||
type DomainExport struct {
|
||||
Format string `json:"format"`
|
||||
Version string `json:"version"`
|
||||
Domain string `json:"domain"`
|
||||
DKIMSelector string `json:"dkim_selector"`
|
||||
DKIMPrivateKey string `json:"dkim_private_key"` // PKCS#1 PEM
|
||||
Applications []AppExport `json:"applications"`
|
||||
}
|
||||
|
||||
// AppExport is one application within a DomainExport.
|
||||
type AppExport struct {
|
||||
Login string `json:"login"`
|
||||
AddressMode string `json:"address_mode"`
|
||||
Addresses []string `json:"addresses,omitempty"` // list mode only
|
||||
Password string `json:"password"`
|
||||
}
|
||||
|
||||
// Export builds the transferable representation of a domain: its DKIM key, its
|
||||
// selector and every application with its address mode and working password
|
||||
// (spec 7.5.B). The returned struct is marshalled to JSON by the caller and
|
||||
// offered as a secret download.
|
||||
func (s *Service) Export(id int64) (DomainExport, error) {
|
||||
d, err := s.store.GetDomain(id)
|
||||
if err != nil {
|
||||
return DomainExport{}, err
|
||||
}
|
||||
pem, err := s.odk.ExportKey(d.Name, d.DKIMSelector)
|
||||
if err != nil {
|
||||
return DomainExport{}, fmt.Errorf("export DKIM key for %s: %w", d.Name, err)
|
||||
}
|
||||
apps, err := s.store.ListApplicationsByDomain(id)
|
||||
if err != nil {
|
||||
return DomainExport{}, err
|
||||
}
|
||||
exp := DomainExport{
|
||||
Format: FormatDomainExport,
|
||||
Version: buildinfo.Version,
|
||||
Domain: d.Name,
|
||||
DKIMSelector: d.DKIMSelector,
|
||||
DKIMPrivateKey: string(pem),
|
||||
Applications: make([]AppExport, 0, len(apps)),
|
||||
}
|
||||
for _, a := range apps {
|
||||
password, err := s.apps.Secret(a.Login)
|
||||
if err != nil {
|
||||
return DomainExport{}, fmt.Errorf("export credential for %s: %w", a.Login, err)
|
||||
}
|
||||
exp.Applications = append(exp.Applications, AppExport{
|
||||
Login: a.Login,
|
||||
AddressMode: a.AddressMode,
|
||||
Addresses: a.Addresses,
|
||||
Password: password,
|
||||
})
|
||||
}
|
||||
return exp, nil
|
||||
}
|
||||
|
||||
// Import re-creates a domain from an export file on this instance (spec 7.5.B):
|
||||
// it stores the imported DKIM key (so the published DNS record needs no change),
|
||||
// registers the domain and rebuilds the OpenDKIM tables, then re-creates each
|
||||
// application with its working password and rebuilds the Postfix sender map.
|
||||
//
|
||||
// exp.Domain must already be normalised and validated by the caller (spec
|
||||
// 7.6.2); the selector is checked for config-injection safety here. A domain or
|
||||
// login that already exists is rejected (store.ErrDomainExists /
|
||||
// store.ErrLoginExists) rather than merged. If any step fails, everything the
|
||||
// import created is rolled back, so a partial import never leaves the instance
|
||||
// in an inconsistent state.
|
||||
func (s *Service) Import(exp DomainExport) (store.Domain, error) {
|
||||
if exp.Format != FormatDomainExport {
|
||||
return store.Domain{}, fmt.Errorf("not a SelfPost domain export (format %q)", exp.Format)
|
||||
}
|
||||
if err := assertConfigSafe(exp.Domain, exp.DKIMSelector); err != nil {
|
||||
return store.Domain{}, err
|
||||
}
|
||||
|
||||
// Registry row first, so its UNIQUE constraint is the sole arbiter of a
|
||||
// duplicate domain before we touch the filesystem.
|
||||
d, err := s.store.AddDomain(exp.Domain, exp.DKIMSelector)
|
||||
if err != nil {
|
||||
return store.Domain{}, err // ErrDomainExists surfaces to the caller
|
||||
}
|
||||
|
||||
if err := s.odk.ImportKey(d.Name, d.DKIMSelector, []byte(exp.DKIMPrivateKey)); err != nil {
|
||||
s.importRollback(d.ID)
|
||||
return store.Domain{}, err
|
||||
}
|
||||
if err := s.resync(); err != nil {
|
||||
s.importRollback(d.ID)
|
||||
return store.Domain{}, err
|
||||
}
|
||||
|
||||
for _, a := range exp.Applications {
|
||||
if err := s.apps.ImportApplication(d.ID, a.Login, a.AddressMode, a.Addresses, a.Password); err != nil {
|
||||
s.importRollback(d.ID)
|
||||
return store.Domain{}, fmt.Errorf("import application %q: %w", a.Login, err)
|
||||
}
|
||||
}
|
||||
if err := s.apps.Resync(); err != nil {
|
||||
s.importRollback(d.ID)
|
||||
return store.Domain{}, err
|
||||
}
|
||||
return d, nil
|
||||
}
|
||||
|
||||
// importRollback best-effort tears down a partially imported domain by running
|
||||
// the normal deletion path, which clears the SASL accounts of any applications
|
||||
// already created, removes the registry rows (cascade), rebuilds both maps and
|
||||
// removes the DKIM key. Any error here is subordinate to the original failure
|
||||
// the caller returns.
|
||||
func (s *Service) importRollback(id int64) {
|
||||
_ = s.Delete(id)
|
||||
}
|
||||
@@ -0,0 +1,190 @@
|
||||
package domain
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"codeberg.org/mix/selfpost/internal/store"
|
||||
)
|
||||
|
||||
// fakeApps stands in for *app.Service in the domain-transfer tests: it records
|
||||
// the import calls and hands back canned SASL secrets.
|
||||
type fakeApps struct {
|
||||
secrets map[string]string
|
||||
imported []importedApp
|
||||
importErr error
|
||||
}
|
||||
|
||||
type importedApp struct {
|
||||
domainID int64
|
||||
login string
|
||||
mode string
|
||||
addresses []string
|
||||
password string
|
||||
}
|
||||
|
||||
func (f *fakeApps) PurgeDomainSASL(int64) error { return nil }
|
||||
func (f *fakeApps) Resync() error { return nil }
|
||||
|
||||
func (f *fakeApps) Secret(login string) (string, error) {
|
||||
pw, ok := f.secrets[login]
|
||||
if !ok {
|
||||
return "", fmt.Errorf("no secret for %q", login)
|
||||
}
|
||||
return pw, nil
|
||||
}
|
||||
|
||||
func (f *fakeApps) ImportApplication(domainID int64, login, mode string, addresses []string, password string) error {
|
||||
if f.importErr != nil {
|
||||
return f.importErr
|
||||
}
|
||||
f.imported = append(f.imported, importedApp{domainID, login, mode, addresses, password})
|
||||
return nil
|
||||
}
|
||||
|
||||
// newTestService builds a Service over a fresh SQLite store and OpenDKIM tree in
|
||||
// a temp dir, with the OpenDKIM reload signal stubbed out.
|
||||
func newTestService(t *testing.T, apps Applications) (*Service, *OpenDKIM) {
|
||||
t.Helper()
|
||||
st, err := store.Open(t.TempDir() + "/selfpost.db")
|
||||
if err != nil {
|
||||
t.Fatalf("open store: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { st.Close() })
|
||||
odk := NewOpenDKIM(t.TempDir())
|
||||
odk.reload = func() error { return nil }
|
||||
return NewService(st, odk, apps, "selfpost"), odk
|
||||
}
|
||||
|
||||
func TestExportImportRoundTrip(t *testing.T) {
|
||||
// Source instance: a domain with two applications and their secrets.
|
||||
srcApps := &fakeApps{secrets: map[string]string{"mailer": "pw-mailer", "alerts": "pw-alerts"}}
|
||||
src, srcOdk := newTestService(t, srcApps)
|
||||
|
||||
d, err := src.Add("example.com")
|
||||
if err != nil {
|
||||
t.Fatalf("add domain: %v", err)
|
||||
}
|
||||
if _, err := src.store.AddApplication(d.ID, "mailer", store.AddressModeWildcard, nil); err != nil {
|
||||
t.Fatalf("add mailer: %v", err)
|
||||
}
|
||||
if _, err := src.store.AddApplication(d.ID, "alerts", store.AddressModeList, []string{"a@example.com"}); err != nil {
|
||||
t.Fatalf("add alerts: %v", err)
|
||||
}
|
||||
|
||||
exp, err := src.Export(d.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("Export: %v", err)
|
||||
}
|
||||
if exp.Format != FormatDomainExport || exp.Domain != "example.com" || exp.DKIMSelector != "selfpost" {
|
||||
t.Fatalf("export header = %+v", exp)
|
||||
}
|
||||
if len(exp.Applications) != 2 {
|
||||
t.Fatalf("exported %d apps, want 2", len(exp.Applications))
|
||||
}
|
||||
srcKey, err := srcOdk.ExportKey("example.com", "selfpost")
|
||||
if err != nil {
|
||||
t.Fatalf("read source key: %v", err)
|
||||
}
|
||||
if exp.DKIMPrivateKey != string(srcKey) {
|
||||
t.Error("export DKIM key does not match the on-disk key")
|
||||
}
|
||||
|
||||
// Target instance: import the file.
|
||||
dstApps := &fakeApps{}
|
||||
dst, dstOdk := newTestService(t, dstApps)
|
||||
nd, err := dst.Import(exp)
|
||||
if err != nil {
|
||||
t.Fatalf("Import: %v", err)
|
||||
}
|
||||
|
||||
// Domain row landed with the exported selector.
|
||||
got, err := dst.Get(nd.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("get imported domain: %v", err)
|
||||
}
|
||||
if got.Name != "example.com" || got.DKIMSelector != "selfpost" {
|
||||
t.Errorf("imported domain = %+v", got)
|
||||
}
|
||||
// The DKIM key was imported byte-for-byte, so the DNS record is unchanged.
|
||||
dstKey, err := dstOdk.ExportKey("example.com", "selfpost")
|
||||
if err != nil {
|
||||
t.Fatalf("read imported key: %v", err)
|
||||
}
|
||||
if string(dstKey) != string(srcKey) {
|
||||
t.Error("imported DKIM key differs from the source key")
|
||||
}
|
||||
// Applications were re-created with their working passwords.
|
||||
if len(dstApps.imported) != 2 {
|
||||
t.Fatalf("imported %d apps, want 2", len(dstApps.imported))
|
||||
}
|
||||
byLogin := map[string]importedApp{}
|
||||
for _, a := range dstApps.imported {
|
||||
byLogin[a.login] = a
|
||||
}
|
||||
if byLogin["mailer"].password != "pw-mailer" || byLogin["alerts"].password != "pw-alerts" {
|
||||
t.Errorf("imported passwords = %+v", dstApps.imported)
|
||||
}
|
||||
if byLogin["alerts"].mode != store.AddressModeList {
|
||||
t.Errorf("alerts mode = %q", byLogin["alerts"].mode)
|
||||
}
|
||||
}
|
||||
|
||||
func TestImportRejectsWrongFormat(t *testing.T) {
|
||||
dst, _ := newTestService(t, &fakeApps{})
|
||||
if _, err := dst.Import(DomainExport{Format: "nope", Domain: "example.com"}); err == nil {
|
||||
t.Error("Import accepted a non-export file")
|
||||
}
|
||||
}
|
||||
|
||||
func TestImportRejectsDuplicateDomain(t *testing.T) {
|
||||
dst, _ := newTestService(t, &fakeApps{})
|
||||
if _, err := dst.Add("example.com"); err != nil {
|
||||
t.Fatalf("seed domain: %v", err)
|
||||
}
|
||||
// A minimal but well-formed export of the same domain.
|
||||
src, srcOdk := newTestService(t, &fakeApps{})
|
||||
d, _ := src.Add("example.com")
|
||||
key, _ := srcOdk.ExportKey("example.com", "selfpost")
|
||||
exp := DomainExport{
|
||||
Format: FormatDomainExport, Domain: "example.com", DKIMSelector: "selfpost",
|
||||
DKIMPrivateKey: string(key),
|
||||
}
|
||||
_ = d
|
||||
if _, err := dst.Import(exp); !errors.Is(err, store.ErrDomainExists) {
|
||||
t.Errorf("Import duplicate = %v, want ErrDomainExists", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestImportRollsBackOnAppFailure(t *testing.T) {
|
||||
// Build a valid export from a source instance.
|
||||
src, _ := newTestService(t, &fakeApps{secrets: map[string]string{"mailer": "pw"}})
|
||||
d, _ := src.Add("example.com")
|
||||
if _, err := src.store.AddApplication(d.ID, "mailer", store.AddressModeWildcard, nil); err != nil {
|
||||
t.Fatalf("add app: %v", err)
|
||||
}
|
||||
exp, err := src.Export(d.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("Export: %v", err)
|
||||
}
|
||||
|
||||
// Target rejects the application import; the whole domain must roll back.
|
||||
dstApps := &fakeApps{importErr: errors.New("boom")}
|
||||
dst, dstOdk := newTestService(t, dstApps)
|
||||
if _, err := dst.Import(exp); err == nil {
|
||||
t.Fatal("Import succeeded despite an application failure")
|
||||
}
|
||||
// Domain row removed.
|
||||
domains, err := dst.List()
|
||||
if err != nil {
|
||||
t.Fatalf("list: %v", err)
|
||||
}
|
||||
if len(domains) != 0 {
|
||||
t.Errorf("expected rollback to remove the domain, got %+v", domains)
|
||||
}
|
||||
// DKIM key removed.
|
||||
if _, err := dstOdk.ExportKey("example.com", "selfpost"); err == nil {
|
||||
t.Error("expected rollback to remove the imported DKIM key")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user