Phase 1: Docker image, supervisord, three-process cold start

Single bookworm-slim image running opendkim + panel + postfix under
supervisord with enforced start ordering (spec 4):

- build/Dockerfile: multi-stage static Go build; runtime installs postfix,
  opendkim, cyrus-sasl, supervisor, logrotate; unprivileged panel user (7.6.8).
- build/supervisord.conf: priority ordering opendkim -> panel -> postfix;
  crashexit event listener terminates the container on any FATAL process.
- build/postfix-wrapper.sh: waits for both milter sockets (test -S, 30s
  timeout) before `postfix start-fg`, exits non-zero on timeout.
- panel: HTTP :8080 stub + /healthz, journal-milter socket stub (so the
  wrapper's readiness probe passes), log-tailer stub; SIGTERM graceful stop.

Verified on the dev server: image builds, three processes live, panel serves
the stub, wrapper waits for sockets, and an unrecoverable panel failure brings
the container down cleanly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

build/Dockerfile

@@ -0,0 +1,79 @@
+# syntax=docker/dockerfile:1
+#
+# SelfPost — single Debian-slim image running postfix + opendkim + panel under
+# supervisord (spec 4). Build from the repository root:
+#
+#     docker build -f build/Dockerfile -t selfpost:dev --build-arg VERSION=dev .
+
+# ---- build stage -------------------------------------------------------------
+FROM golang:1.26-bookworm AS build
+
+WORKDIR /src
+
+# Version stamped into both binaries; MUST match the image tag (spec 7.5.A).
+ARG VERSION=dev
+
+# Module metadata first for layer caching. No go.sum yet — Phase 1 has no
+# third-party dependencies.
+COPY go.mod ./
+RUN go mod download
+
+COPY cmd ./cmd
+COPY internal ./internal
+
+ENV CGO_ENABLED=0
+RUN go vet ./... \
+ && go build -trimpath \
+      -ldflags "-X codeberg.org/mix/selfpost/internal/buildinfo.Version=${VERSION}" \
+      -o /out/panel ./cmd/panel \
+ && go build -trimpath \
+      -ldflags "-X codeberg.org/mix/selfpost/internal/buildinfo.Version=${VERSION}" \
+      -o /out/selfpost-backup ./cmd/selfpost-backup
+
+# ---- runtime stage -----------------------------------------------------------
+FROM debian:bookworm-slim AS runtime
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Preseed Postfix so its install is non-interactive and yields a working
+# main.cf. The real relay configuration is generated by the panel in Phase 5.
+RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
+ && echo "postfix postfix/main_mailer_type string Internet Site" | debconf-set-selections \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends \
+      postfix \
+      opendkim \
+      opendkim-tools \
+      sasl2-bin \
+      libsasl2-modules \
+      supervisor \
+      logrotate \
+      ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+# Postfix logs to a plain file (via its built-in postlogd) so the panel's
+# log-tailer has something to follow and container logging works without syslog.
+RUN postconf -e "maillog_file=/var/log/mail.log"
+
+# Unprivileged user for the panel process (spec 7.6.8).
+RUN useradd --system --no-create-home --shell /usr/sbin/nologin panel
+
+# Runtime directories: milter sockets and the consolidated persistent root.
+RUN mkdir -p /run/opendkim /run/selfpost /data \
+ && chown opendkim:opendkim /run/opendkim \
+ && chown panel:panel /run/selfpost /data
+
+COPY --from=build /out/panel /usr/local/bin/panel
+COPY --from=build /out/selfpost-backup /usr/local/bin/selfpost-backup
+
+COPY build/opendkim.conf /etc/opendkim.conf
+COPY build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh
+COPY build/crashexit.py /usr/local/bin/crashexit.py
+COPY build/supervisord.conf /etc/supervisor/supervisord.conf
+RUN chmod +x /usr/local/bin/postfix-wrapper.sh /usr/local/bin/crashexit.py
+
+# 8080 panel; 25 outbound; 465/587 inbound submission (used from Phase 5).
+EXPOSE 8080 25 465 587
+
+# supervisord is PID 1 and owns process supervision + ordering (spec 4).
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]