panel-dkim-signing: the queue by name, and findings of the reviews

The first rollout of faa3c11 to the test server crash-looped: without
opendkim the image's package accounts got other numbers (postfix 101 ->
100, postdrop 103 -> 102), the queue under /data kept the old ones, and
postsuper, which "postfix check" runs as the mail owner
(src/postsuper/postsuper.c:1442), could not open it. Rolled back within
five minutes. The entrypoint now hands an existing queue to Postfix's users
by name before postfix-config.sh, and again after it (own_queue).

Technical review (F1-F10):
- F1 high: a backup of an upgraded installation carried /data/opendkim, a
  restore left it root's, and the panel refused every start. The tree is
  left out of archives, and the entrypoint makes it the panel's alone
  (0700/0600; also the security review's F3 - nothing of 2.8 needs the
  group any more; a 2.7.x start re-normalises it).
- F2: List-Unsubscribe-Post is signed (RFC 8058); Sender too (security F1).
- F3: SetServerName keeps the name in lower case - a key written under
  "Mail.Example.com" was never found. Only the DKIM side: the SASL realm
  is compared as written.
- F4: the signer rewrites the selector table at every start
  (WriteSelectors, replacing EnsureServerSigned), and tries again every
  10 s while a rewrite fails.
- F5: e2e signature_over_awkward_headers (folded, tab-led, no space, two
  To:, 8-bit body, List-Unsubscribe-Post) checked by dkimpy;
  TestStartsOnA27Data starts on a 2.7 /data (old key tree, a queue of
  foreign numbers) and checks the copied key signs, the old tree's modes
  and the queue's owners; unit tests for repeated headers and the header
  limit.
- F6: the table's writers are serialised (tableMu).
- F7: the table is read for every message; keys the table no longer names
  are dropped from memory.
- F8: the signature's value brings its own space (SMFIP_HDR_LEADSPC gets
  none from Postfix, cleanup_milter.c:1085).
- F9: a body line over 998 bytes is logged with its domain: Postfix's SMTP
  client breaks it after signing (smtp_proto.c:1266-1274).
- F10: the keys are copied while /data/dkim holds none (not only when it
  is absent), after the old tree is made the panel's (an install from 2.6
  had another uid); the plan's rollback note says what a rollback keeps.

Security review: F2 a header section over 1 MiB is refused (552 5.3.4)
and the kept headers freed once the block is built - fifty connections of
header-only messages could take the panel down; F5 the shown headers a
message has (Subject, Date, To, Cc, Reply-To, Sender) are over-signed,
only when present, since cleanup adds a missing Date: after the milters.
F1 (holding Sender: to the login like From:) changes what is refused and
waits for the owner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/service.go

@@ -3,6 +3,8 @@ package domain
 import (
 	"errors"
 	"fmt"
+	"strings"
+	"sync"
 
 	"github.com/mixeme/selfpost/internal/store"
 )
@@ -50,9 +52,13 @@ type Service struct {
 // them the name is signed like a sending domain: it gets a DKIM key and a line
 // in the selector table, without being a row of the registry - no application
 // can send as it. The name comes from SELFPOST_HOSTNAME, which the entrypoint
-// has validated; it is not user input.
+// has validated; it is not user input. It is kept in lower case, as every
+// domain is (validate.NormalizeDomain): the signer finds a key by the name in
+// lower case (internal/milter, SignKeys), and a key written under
+// "Mail.Example.com" would never be found. Only the DKIM side lowers it - the
+// SASL realm, which defaults to the hostname, is compared as written.
 func (s *Service) SetServerName(hostname string) {
-	s.serverName = hostname
+	s.serverName = strings.ToLower(hostname)
 }
 
 // ServerMail is how the server's own name is signed.
@@ -84,29 +90,16 @@ func (s *Service) ServerMail() (ServerMail, error) {
 	return ServerMail{Name: s.serverName, Selector: selector, Record: rec}, nil
 }
 
-// EnsureServerSigned makes sure the selector table has the line for the
-// server's own name, rebuilding it if it does not - or if there is no table
-// yet, as on the first start of 2.8.0, whose table replaced OpenDKIM's. The
-// table is otherwise rebuilt only when a domain is added or deleted, so an
-// installation whose DKIM_SELECTOR_DEFAULT was changed would go on signing
-// with the key of the old selector while the panel shows the record of the
-// new. It reports whether it had to rebuild.
-func (s *Service) EnsureServerSigned() (bool, error) {
-	if s.serverName == "" {
-		return false, nil
-	}
-	selector, err := s.serverSelector()
-	if err != nil {
-		return false, err
-	}
-	signed, err := s.keys.signs(s.serverName, selector)
-	if err != nil {
-		return false, err
-	}
-	if signed {
-		return false, nil
-	}
-	return true, s.resync()
+// WriteSelectors rewrites the selector table from the registry. The signer
+// calls it before it serves (cmd/panel/signer.go): the table is otherwise
+// rewritten only when a domain is added, deleted or imported, by Reload
+// configuration and after a restore, so a start would leave it out of step
+// after a rewrite that was cut short (a panel killed between a domain's row
+// and its line), after a changed DKIM_SELECTOR_DEFAULT (the server's name
+// would be signed with the old selector's key while the panel shows the new
+// record), and on the first start of 2.8.0, which has no table yet.
+func (s *Service) WriteSelectors() error {
+	return s.resync()
 }
 
 // serverSelector is the selector the server's own name is signed with: that of
@@ -297,8 +290,17 @@ func (s *Service) Resync() error {
 	return nil
 }
 
+// tableMu orders the selector table's writers. Each role builds a Service of
+// its own (cmd/panel, newMailStack), and a rewrite is a read of the registry
+// and then a write: without it, a writer that read before another's domain
+// was added could write after it, and the table would lack that domain until
+// the next rewrite.
+var tableMu sync.Mutex
+
 // resync rebuilds the selector table from the current domain set.
 func (s *Service) resync() error {
+	tableMu.Lock()
+	defer tableMu.Unlock()
 	domains, err := s.store.ListDomains()
 	if err != nil {
 		return err