mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Phase 6: journal-milter + send-log status tailer + retention

Browse Source 
Implement the structured send log (spec 7.3), the project's highest-risk
component since a milter bug can break the relay itself.

- internal/milter: go-milter v0.4.1 journal-milter. Per-connection session
  collects SASL login, From, recipients and Subject across callbacks and
  writes one send_log "queued" row per (queue-id, recipient) at EOM
  (spec 7.3.3). Monitoring only: callbacks return Continue/Accept, recorder
  errors are logged never propagated, so it can never block mail.
- internal/logtail: polling mail.log tailer with rotation handling (inode
  change / truncation), parses sent/deferred/bounced/expired by queue-id +
  recipient and advances rows; background retention sweep prunes rows past
  SEND_LOG_RETENTION_DAYS (default 90) at startup and every 6h.
- internal/store/sendlog.go: InsertQueued, UpdateStatus (case-insensitive
  recipient match), DeleteSendLogBefore + status constants.
- cmd/panel: open the store once and share it across http/milter/tailer;
  replace the journal/logtail stubs with the real roles.
- build/postfix-config.sh: bounded milter timeouts (15/15/30s) so a hung
  milter also fails open in seconds, not the 300s default.

Fix found in-container: SASL login (app_login) was empty because go-milter
keys macros exactly as Postfix sends them, and multi-character macro names
arrive brace-wrapped ({auth_authen}); the SASL-less Phase 0 spike could not
observe this. Added a brace-tolerant macro lookup.

Verified on selfpost.mixfed.ru: gofmt/vet/unit tests green; container e2e
records rows with correct fields and advances status via the tailer; fail-open
confirmed for both an unreachable and a hung milter; retention prunes at start.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Микс
2026-07-13 22:58:34 +03:00
parent 2dbd8d009e
commit dc08ccbf7c
13 changed files with 1033 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/panel/httpserver.go
+4 -10
View File
@@ -14,16 +14,10 @@ import (
"codeberg.org/mix/selfpost/internal/web"
)
// serveHTTP opens the panel database and runs the control-panel HTTP server
// until ctx is cancelled. From Phase 2 this serves the real setup, login and
// authenticated panel surface (spec 7.6).
func serveHTTP(ctx context.Context, cfg config) error {
st, err := store.Open(cfg.dbPath)
if err != nil {
return err
}
defer st.Close()
// serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
// the database handle shared by all roles. From Phase 2 this serves the real
// setup, login and authenticated panel surface (spec 7.6).
func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
// Applications own the SASL accounts and the Postfix sender map; the domain
// service delegates to them when a domain (and its applications) is deleted.
pf := postfix.New(cfg.postfixDir)
cmd/panel/journalstub.go → cmd/panel/journal.go
+12 -22
View File
@@ -7,13 +7,17 @@ import (
"net"
"os"
"path/filepath"
"codeberg.org/mix/selfpost/internal/milter"
"codeberg.org/mix/selfpost/internal/store"
)
// serveJournalStub opens the journal-milter Unix socket so the Postfix start
// wrapper's readiness probe (test -S) succeeds and the cold-start ordering
// (spec 4) can be exercised end to end. The real milter protocol handler is
// implemented in Phase 6; here connections are simply accepted and closed.
func serveJournalStub(ctx context.Context, socketPath string) error {
// serveJournal opens the journal-milter Unix socket and runs the real milter
// (spec 7.3), recording accepted messages into the send log. Socket lifecycle
// (creation, stale cleanup, group permissions) lives here; the protocol handler
// lives in internal/milter.
func serveJournal(ctx context.Context, cfg config, st *store.Store) error {
socketPath := cfg.journalSocket
if err := os.MkdirAll(filepath.Dir(socketPath), 0o755); err != nil {
return err
}
@@ -32,24 +36,10 @@ func serveJournalStub(ctx context.Context, socketPath string) error {
// dir entrypoint.sh prepares; make it group read/write so postfix can reach
// it (connecting to a Unix socket needs write permission on the node).
if err := os.Chmod(socketPath, 0o660); err != nil {
ln.Close()
return err
}
// Closing the listener unblocks Accept and unlinks the socket file.
go func() {
<-ctx.Done()
_ = ln.Close()
}()
log.Printf("journal-milter stub listening on %s", socketPath)
for {
conn, err := ln.Accept()
if err != nil {
if ctx.Err() != nil {
return nil // expected during shutdown
}
return err
}
_ = conn.Close()
}
log.Printf("journal-milter listening on %s", socketPath)
return milter.Serve(ctx, ln, st)
}
cmd/panel/logtailstub.go
-16
View File
@@ -1,16 +0,0 @@
package main
import (
"context"
"log"
)
// tailMailLog is the Phase 1 placeholder for the log-tailer role. In Phase 6 it
// will follow mail.log and reconcile send-log delivery statuses by queue-id;
// for now it just idles until shutdown so the role is present in the process
// tree and its wiring is exercised.
func tailMailLog(ctx context.Context, path string) error {
log.Printf("log-tailer stub active (will follow %s in Phase 6)", path)
<-ctx.Done()
return nil
}
cmd/panel/main.go
+31 -3
View File
@@ -15,10 +15,13 @@ import (
"os"
"os/signal"
"path/filepath"
"strconv"
"sync"
"syscall"
"codeberg.org/mix/selfpost/internal/buildinfo"
"codeberg.org/mix/selfpost/internal/logtail"
"codeberg.org/mix/selfpost/internal/store"
)
func main() {
@@ -44,6 +47,7 @@ type config struct {
httpAddr string
journalSocket string
mailLog string
retentionDays int
dataDir string
dbPath string
@@ -65,6 +69,9 @@ func loadConfig() config {
httpAddr: envDefault("PANEL_HTTP_ADDR", ":8080"),
journalSocket: envDefault("JOURNAL_MILTER_SOCKET", "/run/selfpost/journal.sock"),
mailLog: envDefault("MAIL_LOG", "/var/log/mail.log"),
// Send-log retention window (spec 7.3). Non-positive/invalid falls back
// to the 90-day default inside the log-tailer.
retentionDays: envInt("SEND_LOG_RETENTION_DAYS", 90),
dataDir: dataDir,
dbPath: envDefault("SELFPOST_DB_PATH", filepath.Join(dataDir, "selfpost.db")),
@@ -109,6 +116,18 @@ func envDefault(key, def string) string {
return def
}
// envInt reads an integer environment variable, returning def if it is unset or
// not a valid integer.
func envInt(key string, def int) int {
if v := os.Getenv(key); v != "" {
if n, err := strconv.Atoi(v); err == nil {
return n
}
log.Printf("ignoring invalid %s=%q, using %d", key, v, def)
}
return def
}
// run starts the panel's three roles and blocks until a shutdown signal or the
// first fatal error from any role. A signal triggers a clean stop of all roles;
// a role error cancels the others and is returned so the process exits non-zero
@@ -121,6 +140,15 @@ func run() error {
log.Printf("starting selfpost panel %s", buildinfo.Version)
// One database handle shared by every role. The store serialises writes
// (MaxOpenConns(1)), so the HTTP panel, the journal-milter and the tailer
// can all use it without stepping on each other under WAL.
st, err := store.Open(cfg.dbPath)
if err != nil {
return err
}
defer st.Close()
var wg sync.WaitGroup
errc := make(chan error, 3)
@@ -128,9 +156,9 @@ func run() error {
name string
fn func(context.Context) error
}{
{"http", func(ctx context.Context) error { return serveHTTP(ctx, cfg) }},
{"journal-milter", func(ctx context.Context) error { return serveJournalStub(ctx, cfg.journalSocket) }},
{"log-tailer", func(ctx context.Context) error { return tailMailLog(ctx, cfg.mailLog) }},
{"http", func(ctx context.Context) error { return serveHTTP(ctx, cfg, st) }},
{"journal-milter", func(ctx context.Context) error { return serveJournal(ctx, cfg, st) }},
{"log-tailer", func(ctx context.Context) error { return logtail.Run(ctx, cfg.mailLog, st, cfg.retentionDays) }},
}
for _, r := range roles {