Phase 1: Docker image, supervisord, three-process cold start

Single bookworm-slim image running opendkim + panel + postfix under
supervisord with enforced start ordering (spec 4):

- build/Dockerfile: multi-stage static Go build; runtime installs postfix,
  opendkim, cyrus-sasl, supervisor, logrotate; unprivileged panel user (7.6.8).
- build/supervisord.conf: priority ordering opendkim -> panel -> postfix;
  crashexit event listener terminates the container on any FATAL process.
- build/postfix-wrapper.sh: waits for both milter sockets (test -S, 30s
  timeout) before `postfix start-fg`, exits non-zero on timeout.
- panel: HTTP :8080 stub + /healthz, journal-milter socket stub (so the
  wrapper's readiness probe passes), log-tailer stub; SIGTERM graceful stop.

Verified on the dev server: image builds, three processes live, panel serves
the stub, wrapper waits for sockets, and an unrecoverable panel failure brings
the container down cleanly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cmd/panel/main.go

@@ -2,14 +2,20 @@
 // single binary combines several roles (spec 7.1): the HTTP panel server,
 // the journal-milter, the mail.log tailer and the rate-limit checks.
 //
-// This is the Phase 0 skeleton: it only reports its version so the build
-// pipeline (ldflags stamping, docker build) can be wired up end to end.
+// Phase 1 wires those roles up as a supervised process with a minimal HTTP
+// stub, a journal-milter socket stub (so the Postfix start wrapper's readiness
+// probe passes) and a log-tailer stub. Real behaviour lands in later phases.
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
+	"log"
 	"os"
+	"os/signal"
+	"sync"
+	"syscall"
 
 	"codeberg.org/mix/selfpost/internal/buildinfo"
 )
@@ -23,5 +29,81 @@ func main() {
 		return
 	}
 
-	fmt.Fprintf(os.Stdout, "selfpost panel %s (skeleton)\n", buildinfo.Version)
+	log.SetFlags(log.LstdFlags | log.LUTC)
+	log.SetPrefix("panel: ")
+
+	if err := run(); err != nil {
+		log.Fatalf("fatal: %v", err)
+	}
+}
+
+// config holds the runtime knobs the panel reads from the environment. Every
+// value has a safe default so the binary also runs outside the container.
+type config struct {
+	httpAddr      string
+	journalSocket string
+	mailLog       string
+}
+
+func loadConfig() config {
+	return config{
+		httpAddr:      envDefault("PANEL_HTTP_ADDR", ":8080"),
+		journalSocket: envDefault("JOURNAL_MILTER_SOCKET", "/run/selfpost/journal.sock"),
+		mailLog:       envDefault("MAIL_LOG", "/var/log/mail.log"),
+	}
+}
+
+func envDefault(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
+
+// run starts the panel's three roles and blocks until a shutdown signal or the
+// first fatal error from any role. A signal triggers a clean stop of all roles;
+// a role error cancels the others and is returned so the process exits non-zero
+// (letting supervisord/Docker see the failure — spec 4).
+func run() error {
+	cfg := loadConfig()
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	log.Printf("starting selfpost panel %s", buildinfo.Version)
+
+	var wg sync.WaitGroup
+	errc := make(chan error, 3)
+
+	roles := []struct {
+		name string
+		fn   func(context.Context) error
+	}{
+		{"http", func(ctx context.Context) error { return serveHTTP(ctx, cfg.httpAddr) }},
+		{"journal-milter", func(ctx context.Context) error { return serveJournalStub(ctx, cfg.journalSocket) }},
+		{"log-tailer", func(ctx context.Context) error { return tailMailLog(ctx, cfg.mailLog) }},
+	}
+
+	for _, r := range roles {
+		wg.Add(1)
+		go func(name string, fn func(context.Context) error) {
+			defer wg.Done()
+			if err := fn(ctx); err != nil {
+				errc <- fmt.Errorf("%s: %w", name, err)
+			}
+		}(r.name, r.fn)
+	}
+
+	select {
+	case <-ctx.Done():
+		log.Printf("shutdown signal received, stopping")
+		wg.Wait()
+		log.Printf("panel stopped cleanly")
+		return nil
+	case err := <-errc:
+		log.Printf("role failed: %v", err)
+		stop() // cancel ctx so the other roles wind down
+		wg.Wait()
+		return err
+	}
 }