Phase 1: Docker image, supervisord, three-process cold start

Single bookworm-slim image running opendkim + panel + postfix under supervisord with enforced start ordering (spec 4): - build/Dockerfile: multi-stage static Go build; runtime installs postfix, opendkim, cyrus-sasl, supervisor, logrotate; unprivileged panel user (7.6.8). - build/supervisord.conf: priority ordering opendkim -> panel -> postfix; crashexit event listener terminates the container on any FATAL process. - build/postfix-wrapper.sh: waits for both milter sockets (test -S, 30s timeout) before `postfix start-fg`, exits non-zero on timeout. - panel: HTTP :8080 stub + /healthz, journal-milter socket stub (so the wrapper's readiness probe passes), log-tailer stub; SIGTERM graceful stop. Verified on the dev server: image builds, three processes live, panel serves the stub, wrapper waits for sockets, and an unrecoverable panel failure brings the container down cleanly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-11 15:14:08 +03:00
parent cc2d9d43c0
commit e6aceeb811
10 changed files with 467 additions and 3 deletions
@@ -0,0 +1,67 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net/http"
+	"time"
+)
+
+// serveHTTP runs the panel's HTTP server until ctx is cancelled. Phase 1 serves
+// only a placeholder page and a health check; the login flow and real UI arrive
+// in Phase 2.
+func serveHTTP(ctx context.Context, addr string) error {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/healthz", handleHealth)
+	mux.HandleFunc("/", handleIndex)
+
+	srv := &http.Server{
+		Addr:              addr,
+		Handler:           mux,
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+
+	// Shut the server down cleanly when the process is asked to stop.
+	go func() {
+		<-ctx.Done()
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = srv.Shutdown(shutdownCtx)
+	}()
+
+	log.Printf("http panel listening on %s", addr)
+	if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		return err
+	}
+	return nil
+}
+
+func handleHealth(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write([]byte("ok\n"))
+}
+
+func handleIndex(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path != "/" {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	_, _ = w.Write([]byte(indexHTML))
+}
+
+const indexHTML = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>SelfPost</title>
+</head>
+<body>
+<h1>SelfPost</h1>
+<p>The control panel is starting up. Administrator setup and login arrive in a later build.</p>
+</body>
+</html>
+`
@@ -0,0 +1,48 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net"
+	"os"
+	"path/filepath"
+)
+
+// serveJournalStub opens the journal-milter Unix socket so the Postfix start
+// wrapper's readiness probe (test -S) succeeds and the cold-start ordering
+// (spec 4) can be exercised end to end. The real milter protocol handler is
+// implemented in Phase 6; here connections are simply accepted and closed.
+func serveJournalStub(ctx context.Context, socketPath string) error {
+	if err := os.MkdirAll(filepath.Dir(socketPath), 0o755); err != nil {
+		return err
+	}
+	// Clear a stale socket left behind by an unclean shutdown, otherwise the
+	// listen below fails with "address already in use".
+	if err := os.Remove(socketPath); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+
+	ln, err := net.Listen("unix", socketPath)
+	if err != nil {
+		return err
+	}
+
+	// Closing the listener unblocks Accept and unlinks the socket file.
+	go func() {
+		<-ctx.Done()
+		_ = ln.Close()
+	}()
+
+	log.Printf("journal-milter stub listening on %s", socketPath)
+	for {
+		conn, err := ln.Accept()
+		if err != nil {
+			if ctx.Err() != nil {
+				return nil // expected during shutdown
+			}
+			return err
+		}
+		_ = conn.Close()
+	}
+}
@@ -0,0 +1,16 @@
+package main
+
+import (
+	"context"
+	"log"
+)
+
+// tailMailLog is the Phase 1 placeholder for the log-tailer role. In Phase 6 it
+// will follow mail.log and reconcile send-log delivery statuses by queue-id;
+// for now it just idles until shutdown so the role is present in the process
+// tree and its wiring is exercised.
+func tailMailLog(ctx context.Context, path string) error {
+	log.Printf("log-tailer stub active (will follow %s in Phase 6)", path)
+	<-ctx.Done()
+	return nil
+}
@@ -2,14 +2,20 @@
 // single binary combines several roles (spec 7.1): the HTTP panel server,
 // the journal-milter, the mail.log tailer and the rate-limit checks.
 //
-// This is the Phase 0 skeleton: it only reports its version so the build
-// pipeline (ldflags stamping, docker build) can be wired up end to end.
+// Phase 1 wires those roles up as a supervised process with a minimal HTTP
+// stub, a journal-milter socket stub (so the Postfix start wrapper's readiness
+// probe passes) and a log-tailer stub. Real behaviour lands in later phases.
 package main

 import (
+	"context"
 	"flag"
 	"fmt"
+	"log"
 	"os"
+	"os/signal"
+	"sync"
+	"syscall"

 	"codeberg.org/mix/selfpost/internal/buildinfo"
 )
@@ -23,5 +29,81 @@ func main() {
 		return
 	}

-	fmt.Fprintf(os.Stdout, "selfpost panel %s (skeleton)\n", buildinfo.Version)
+	log.SetFlags(log.LstdFlags | log.LUTC)
+	log.SetPrefix("panel: ")
+
+	if err := run(); err != nil {
+		log.Fatalf("fatal: %v", err)
+	}
+}
+
+// config holds the runtime knobs the panel reads from the environment. Every
+// value has a safe default so the binary also runs outside the container.
+type config struct {
+	httpAddr      string
+	journalSocket string
+	mailLog       string
+}
+
+func loadConfig() config {
+	return config{
+		httpAddr:      envDefault("PANEL_HTTP_ADDR", ":8080"),
+		journalSocket: envDefault("JOURNAL_MILTER_SOCKET", "/run/selfpost/journal.sock"),
+		mailLog:       envDefault("MAIL_LOG", "/var/log/mail.log"),
+	}
+}
+
+func envDefault(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
+
+// run starts the panel's three roles and blocks until a shutdown signal or the
+// first fatal error from any role. A signal triggers a clean stop of all roles;
+// a role error cancels the others and is returned so the process exits non-zero
+// (letting supervisord/Docker see the failure — spec 4).
+func run() error {
+	cfg := loadConfig()
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	log.Printf("starting selfpost panel %s", buildinfo.Version)
+
+	var wg sync.WaitGroup
+	errc := make(chan error, 3)
+
+	roles := []struct {
+		name string
+		fn   func(context.Context) error
+	}{
+		{"http", func(ctx context.Context) error { return serveHTTP(ctx, cfg.httpAddr) }},
+		{"journal-milter", func(ctx context.Context) error { return serveJournalStub(ctx, cfg.journalSocket) }},
+		{"log-tailer", func(ctx context.Context) error { return tailMailLog(ctx, cfg.mailLog) }},
+	}
+
+	for _, r := range roles {
+		wg.Add(1)
+		go func(name string, fn func(context.Context) error) {
+			defer wg.Done()
+			if err := fn(ctx); err != nil {
+				errc <- fmt.Errorf("%s: %w", name, err)
+			}
+		}(r.name, r.fn)
+	}
+
+	select {
+	case <-ctx.Done():
+		log.Printf("shutdown signal received, stopping")
+		wg.Wait()
+		log.Printf("panel stopped cleanly")
+		return nil
+	case err := <-errc:
+		log.Printf("role failed: %v", err)
+		stop() // cancel ctx so the other roles wind down
+		wg.Wait()
+		return err
+	}
 }