release: cut 1.0.0

Pin compose and local trial to ghcr.io/mixeme/selfpost:1.0.0, close the
CHANGELOG cut, and retire implementation-plan / v1.x-closure-plan.

Includes the post-cut startup fixes needed for a green release e2e gate:
root-owned TLS copies for postfix check, maillog_file_prefixes for /data,
hostname gate and traversable /data, panel /healthz before setup, and
setup-token / TempDir reclaim via docker exec.

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

test/e2e/compose.override.yml

@@ -16,6 +16,10 @@
 
 services:
   selfpost:
+    # Crash-looping with unless-stopped makes `compose exec` fail with
+    # "Container is restarting" and hides the entrypoint/supervisord exit
+    # reason; keep the stand exited so logs stay attached to one attempt.
+    restart: "no"
     build:
       # Resolved relative to --project-directory (.stage), NOT this file's own
       # directory — compose build.context paths follow the project directory,

test/e2e/hostname_gate_test.go

@@ -16,6 +16,11 @@ import (
 func runEntrypoint(t *testing.T, hostnameEnv string) (output string, exitedZero bool) {
 	t.Helper()
 	dataDir := t.TempDir()
+	// Entrypoint also chmod 755 /data; mirror that here so a pre-fix image
+	// still gets a traversable bind mount under Go's 0700 TempDir.
+	if err := os.Chmod(dataDir, 0o755); err != nil {
+		t.Fatalf("chmod data dir: %v", err)
+	}
 
 	args := []string{
 		"run", "--rm",
@@ -72,13 +77,22 @@ func TestHostnameGate(t *testing.T) {
 func runEntrypointBackground(t *testing.T, hostnameEnv string) (output string, started bool) {
 	t.Helper()
 	dataDir := t.TempDir()
+	if err := os.Chmod(dataDir, 0o755); err != nil {
+		t.Fatalf("chmod data dir: %v", err)
+	}
 	certDir := t.TempDir()
 	if err := writeSelfSignedCert(certDir+"/fullchain.pem", certDir+"/privkey.pem"); err != nil {
 		t.Fatalf("generate throwaway TLS cert: %v", err)
 	}
 	name := "selfpost-e2e-hostname-check"
 	_ = exec.Command("docker", "rm", "-f", name).Run()
-	defer exec.Command("docker", "rm", "-f", name).Run()
+	defer func() {
+		// Make bind-mounted /data deletable by Go's TempDir cleanup: the panel
+		// leaves setup-token/db/opendkim owned by container UIDs.
+		_ = exec.Command("docker", "exec", name, "sh", "-c",
+			"chown -R root:root /data && chmod -R a+rwX /data").Run()
+		_ = exec.Command("docker", "rm", "-f", name).Run()
+	}()
 
 	up := exec.Command("docker", "run", "-d", "--name", name,
 		"-e", "SELFPOST_HOSTNAME="+hostnameEnv,

test/e2e/main_test.go

@@ -1,13 +1,13 @@
-// Package e2e is the hermetic container e2e gate (plan C.4): it drives the
-// shipped deploy/docker-compose.yml (plus a test-only override) exactly as an
+// Package e2e is the hermetic container e2e gate: it drives the shipped
+// deploy/docker-compose.yml (plus a test-only override) exactly as an
 // administrator and their applications would, so the class of failure unit
 // tests cannot see — broken container wiring — has one place to be caught
 // before an image is published.
 //
-// It is a separate module on purpose (see ../../docs/implementation-plan.md,
-// item C.4): `go test ./...` in the main module never pulls this in, and its
-// test-only dependencies (DKIM verification) never enter the shipped
-// binaries' build graph.
+// It is a separate module on purpose (see ../../docs/development.md):
+// `go test ./...` in the main module never pulls this in, and its test-only
+// dependencies (DKIM verification) never enter the shipped binaries' build
+// graph.
 package e2e
 
 import (
@@ -54,6 +54,10 @@ func TestMain(m *testing.M) {
 			fmt.Fprintf(os.Stderr, "\n==== logs: %s ====\n%s\n", svc, s.logs(svc))
 		}
 	}
+	// Panel/postfix-owned files under the /data bind mount outlive the
+	// container; reclaim ownership while selfpost is still up so a later
+	// prepareStage RemoveAll (or a local re-run) is not stuck on EACCES.
+	s.reclaimData()
 	s.down()
 	os.Exit(code)
 }
@@ -87,14 +91,27 @@ type scenario struct {
 func TestE2E(t *testing.T) {
 	sc := &scenario{}
 
-	t.Run("startup_processes_running", func(t *testing.T) {
+	// Ordered scenario: each step needs state from earlier ones. A failed
+	// subtest must stop the rest — otherwise sc.panel stays nil and the next
+	// step panics, masking the real failure (as seen on the v1.0.0 release CI).
+	run := func(name string, fn func(*testing.T)) {
+		if t.Failed() {
+			return
+		}
+		t.Run(name, fn)
+	}
+
+	run("startup_processes_running", func(t *testing.T) {
 		if err := checkSupervisorProcesses(h); err != nil {
 			t.Fatal(err)
 		}
+		if err := waitForPanelReady(); err != nil {
+			t.Fatal(err)
+		}
 	})
 
-	t.Run("setup_and_login", func(t *testing.T) {
-		token, err := readSetupToken(h.stageDir)
+	run("setup_and_login", func(t *testing.T) {
+		token, err := readSetupToken(h)
 		if err != nil {
 			t.Fatalf("read setup token: %v", err)
 		}
@@ -111,7 +128,7 @@ func TestE2E(t *testing.T) {
 		sc.panel = p
 	})
 
-	t.Run("add_domain_and_publish_dkim", func(t *testing.T) {
+	run("add_domain_and_publish_dkim", func(t *testing.T) {
 		id, err := sc.panel.addDomain(senderDomain)
 		if err != nil {
 			t.Fatalf("add domain: %v", err)
@@ -137,7 +154,7 @@ func TestE2E(t *testing.T) {
 		sc.zoneRecords = records
 	})
 
-	t.Run("add_application", func(t *testing.T) {
+	run("add_application", func(t *testing.T) {
 		login, password, err := sc.panel.addApplication(sc.domainID, "app1", "wildcard", "")
 		if err != nil {
 			t.Fatalf("add application: %v", err)
@@ -145,7 +162,7 @@ func TestE2E(t *testing.T) {
 		sc.appLogin, sc.appPassword = login, password
 	})
 
-	t.Run("send_verify_dkim_and_status", func(t *testing.T) {
+	run("send_verify_dkim_and_status", func(t *testing.T) {
 		token := uniqueToken("positive")
 		res := attemptSend(sendAttempt{
 			authLogin: sc.appLogin, authPassword: sc.appPassword,
@@ -179,25 +196,25 @@ func TestE2E(t *testing.T) {
 		}
 	})
 
-	t.Run("negative_level2_ratelimit_via_panel", func(t *testing.T) {
+	run("negative_level2_ratelimit_via_panel", func(t *testing.T) {
 		testLevel2RateLimit(t, sc)
 	})
-	t.Run("negative_sender_login_mismatch", func(t *testing.T) {
+	run("negative_sender_login_mismatch", func(t *testing.T) {
 		testSenderLoginMismatch(t, sc)
 	})
-	t.Run("negative_no_auth_rejected", func(t *testing.T) {
+	run("negative_no_auth_rejected", func(t *testing.T) {
 		testNoAuthRejected(t, sc)
 	})
-	t.Run("negative_foreign_relay_rejected", func(t *testing.T) {
+	run("negative_foreign_relay_rejected", func(t *testing.T) {
 		testForeignRelayRejected(t, sc)
 	})
-	t.Run("negative_journal_milter_fail_open", func(t *testing.T) {
+	run("negative_journal_milter_fail_open", func(t *testing.T) {
 		testJournalMilterFailOpen(t, sc)
 	})
-	t.Run("session_survives_restart", func(t *testing.T) {
+	run("session_survives_restart", func(t *testing.T) {
 		testSessionSurvivesRestart(t, sc)
 	})
-	t.Run("negative_level1_ratelimit", func(t *testing.T) {
+	run("negative_level1_ratelimit", func(t *testing.T) {
 		testLevel1RateLimit(t, sc)
 	})
 }

test/e2e/panel_client.go

@@ -7,8 +7,6 @@ import (
 	"net/http"
 	"net/http/cookiejar"
 	"net/url"
-	"os"
-	"path/filepath"
 	"regexp"
 	"strings"
 	"time"
@@ -39,22 +37,48 @@ func newPanelClient() (*panelClient, error) {
 	}}, nil
 }
 
-// readSetupToken reads the one-time setup URL SelfPost wrote to /data (bind
-// mounted at stageDir/data/setup-token) and returns just the token.
-func readSetupToken(stageDir string) (string, error) {
-	var raw []byte
-	err := waitFor("setup-token to appear", 30*time.Second, 300*time.Millisecond, func() (bool, error) {
-		b, err := os.ReadFile(filepath.Join(stageDir, "data", "setup-token"))
+// waitForPanelReady polls the host-published panel port until /healthz
+// returns 200. Supervisor reporting the panel process RUNNING is not enough:
+// the setup-token file is written in Start() before ListenAndServe, and
+// Docker's host-port publish can lag the in-container bind — either race
+// makes the first setup POST fail and leaves sc.panel nil for later steps.
+func waitForPanelReady() error {
+	client := &http.Client{Timeout: 2 * time.Second}
+	return waitFor("panel /healthz on "+panelBaseURL, 60*time.Second, 200*time.Millisecond, func() (bool, error) {
+		resp, err := client.Get(panelBaseURL + "/healthz")
 		if err != nil {
 			return false, err
 		}
-		raw = b
-		return len(b) > 0, nil
+		defer resp.Body.Close()
+		_, _ = io.Copy(io.Discard, resp.Body)
+		if resp.StatusCode != http.StatusOK {
+			return false, fmt.Errorf("status %d", resp.StatusCode)
+		}
+		return true, nil
+	})
+}
+
+// readSetupToken reads the one-time setup URL from /data/setup-token inside
+// the running selfpost container. The file is mode 0600 owned by the panel
+// UID (security.md / setup.go); on a typical CI bind mount that is not the
+// host runner's UID, so a host-side os.ReadFile returns permission denied
+// even though the panel already wrote the token (CI: setup_and_login).
+// Reading via compose exec matches docs/guide.md ("docker compose exec
+// selfpost cat /data/setup-token").
+func readSetupToken(s *stack) (string, error) {
+	var raw string
+	err := waitFor("setup-token to appear", 30*time.Second, 300*time.Millisecond, func() (bool, error) {
+		out, err := s.execIn("selfpost", "cat", "/data/setup-token")
+		if err != nil {
+			return false, err
+		}
+		raw = out
+		return strings.TrimSpace(out) != "", nil
 	})
 	if err != nil {
 		return "", err
 	}
-	u, err := url.Parse(strings.TrimSpace(string(raw)))
+	u, err := url.Parse(strings.TrimSpace(raw))
 	if err != nil {
 		return "", fmt.Errorf("parse setup token file: %w", err)
 	}

test/e2e/process_check.go

@@ -45,7 +45,10 @@ func checkSupervisorProcesses(s *stack) error {
 		}
 		return true, nil
 	})
-	return err
+	if err != nil {
+		return fmt.Errorf("%w\n==== selfpost logs ====\n%s", err, s.logs("selfpost"))
+	}
+	return nil
 }
 
 func parseSupervisorStatus(out string) map[string]string {

test/e2e/stack.go

@@ -106,6 +106,14 @@ func (s *stack) down() {
 	_, _ = s.compose("down", "-v", "--remove-orphans")
 }
 
+// reclaimData chowns/chmods the /data bind mount from inside the still-running
+// selfpost container so the host test user can delete it afterwards. Files
+// written as panel/postfix (setup-token 0600, opendkim tree, sqlite) otherwise
+// leave EACCES on TempDir/stage cleanup (CI hostname-gate + prepareStage).
+func (s *stack) reclaimData() {
+	_, _ = s.execIn("selfpost", "sh", "-c", "chown -R root:root /data && chmod -R a+rwX /data")
+}
+
 // logs returns a service's combined stdout/stderr, for failure diagnostics.
 func (s *stack) logs(service string) string {
 	out, _ := s.compose("logs", "--no-color", service)

test/e2e/stage.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"math/big"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"time"
 )
@@ -23,7 +24,7 @@ const selfpostHostname = "mail.e2e.test"
 // CoreDNS is authoritative for, and the sink-MX's dump directory. Called once
 // per run before `docker compose up`, so every run starts from a clean slate.
 func prepareStage(s *stack) error {
-	if err := os.RemoveAll(s.stageDir); err != nil {
+	if err := removeAllBestEffort(s.stageDir); err != nil {
 		return fmt.Errorf("clean stage dir: %w", err)
 	}
 	dirs := []string{"data", "certs", "dns-stage", "mail-stage"}
@@ -48,6 +49,17 @@ func prepareStage(s *stack) error {
 	return writeZone(s.stageDir, nil)
 }
 
+// removeAllBestEffort deletes path; if a previous run left container-UID files
+// on the bind mount, a root alpine one-shot removes them first.
+func removeAllBestEffort(path string) error {
+	if err := os.RemoveAll(path); err == nil {
+		return nil
+	}
+	_ = exec.Command("docker", "run", "--rm", "-v", path+":/wipe", "alpine:3.20",
+		"sh", "-c", "rm -rf /wipe/..?* /wipe/.[!.]* /wipe/*").Run()
+	return os.RemoveAll(path)
+}
+
 // writeSelfSignedCert generates a throwaway RSA key + self-signed certificate
 // for selfpostHostname, valid for a day — this stand never outlives that.
 // Postfix's smtpd_tls_security_level is "may" (opportunistic), not enforced,