mixandClaude Opus 5.5
fbd0acd035
test / test (push) Canceled after 0s
Code and config: - C-M7: a DMARC report's explicit <pct>0</pct> stays 0; only an absent pct takes RFC 7489 § 6.3's default 100 (Pct *int). - C-D1: docs/development.md now tables the Debian versions the citations were read at (postfix 3.7.11-0+deb12u1, opendkim and libopendkim11 2.11.0~beta2-8+deb12u1, libmilter1.0.1 8.17.1.9-2+deb12u2, libsasl2-2 and sasl2-bin 2.1.28+dfsg-10, supervisor 4.2.5-1, logrotate 3.21.0-1 - read off the image with dpkg-query, 2026-10-15); the e2e stand's new checkCitedPackageVersions fails when the image it built differs. - C-E2: the e2e zone's SOA serial only grows (CoreDNS v1.14.6's file plugin reloads on a grown serial, not on mtime); Corefile comment says so; TestZoneSerialGrows. - C-K8, C-K9: the e2e compose and stage comments say how --project-directory and .env resolve. - D-arch:154: postfix-config.sh's "Postfix insists" comment says what TLS_README advises and that smtpd reads the key as root. - B-G7: inflight.go's reservationTTL comment: a dropped client does give ABORT (smtpd_proto() -> mail_reset() -> milter_abort()); the TTL is for smtpd dying or the milter connection breaking. - D-guide:301: the nginx fragment's first-certificate command now reaches certbot (--entrypoint certbot, --standalone, port 80 free), and the renewal loop passes --webroot -w /var/www/certbot - a standalone certificate would otherwise renew standalone while nginx holds port 80 (certbot docs, "Renewing certificates": the issuing plugin is used "unless you specify other plugins or options", and options of a successful renewal are saved). The register's proposal missed that. Documents: every D-arch, D-guide and D-sec claim the register's Answers E found false or partly true, rewritten - by three Sonnet agents, one per document, then reviewed: two proposals were obsolete after this stage's fixes and not used (a bounce's From: line - extract_from = "smtp" now; "Origin: null" - Referrer-Policy is same-origin now); a stand observation the agent had dated from a commit is now tied to the e2e test that checks it; the SQLite writers paragraph describes _txlock=immediate; the log tailer's rotation paragraph describes the minute's grace; the guide's nginx steps were put in working order (links and modes before `up`, no reconfigure step). "Deferred" is kept for Postfix's queue in the guide too. guide.md's CRLF from the agent normalised. Stand (2026-10-15, make e2e, exit 0, the version gate and zone serial test included); go vet and go test ./... pass on the server (24 packages). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
75 lines
3.5 KiB
YAML
75 lines
3.5 KiB
YAML
|
|
# Alternative reverse-proxy: nginx. PEM files land on the host exactly like the
|
|
# Apache+certbot scenario — nginx and certbot are close cousins here, both
|
|
# writing/reading plain PEM under /etc/letsencrypt.
|
|
#
|
|
# This is a FRAGMENT, not a full replacement for ../docker-compose.yml: it
|
|
# adds an nginx + certbot pair and removes the panel's host port publish (nginx
|
|
# takes over 80/443 and proxies to the panel over the compose network
|
|
# instead). Merge it with the base file — run this from the deploy/ directory
|
|
# (Compose resolves every relative path in both files against the directory of
|
|
# the FIRST -f file, i.e. deploy/, which is why paths below are ./nginx/... -
|
|
# docs.docker.com/compose/how-tos/multiple-compose-files/merge/: "Paths are
|
|
# evaluated relative to the base file"):
|
|
#
|
|
# docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
|
|
#
|
|
# First-run certificate issuance, before nginx has a certificate to serve -
|
|
# run once, with port 80 free (certbot answers the challenge itself;
|
|
# --webroot would need nginx already serving /.well-known). --entrypoint is
|
|
# needed: the service's own entrypoint is the renewal loop below, an
|
|
# `sh -c` that ignores any arguments given to `run`
|
|
# (docs.docker.com/reference/compose-file/services/#entrypoint; assumptions
|
|
# D-guide:301):
|
|
# docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
|
|
# run --rm -p 80:80 --entrypoint certbot certbot certonly --standalone \
|
|
# -d mail.example.com --email you@example.com --agree-tos --no-eff-email
|
|
|
|
services:
|
|
selfpost:
|
|
ports: !override
|
|
- "465:465"
|
|
- "587:587"
|
|
- "25:25"
|
|
# No host publish for 8080 here: nginx reaches it over the compose
|
|
# network at selfpost:8080 instead (see nginx.conf.example).
|
|
volumes: !override
|
|
- ./data:/data
|
|
- .:/selfpost-deploy:ro
|
|
# certs/ holds two links, fullchain.pem and privkey.pem, to
|
|
# /etc/letsencrypt/live/mail.example.com/ - a path inside the
|
|
# container: certbot's directory below is mounted there whole, because
|
|
# its live/ files are relative links into archive/ (mounting live/ alone
|
|
# left them pointing at nothing). docs/guide.md, "Reverse proxy", nginx.
|
|
- ./certs:/etc/postfix/tls:ro
|
|
- ./nginx/certbot-etc:/etc/letsencrypt:ro
|
|
|
|
nginx:
|
|
image: nginx:1.27
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- selfpost
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./nginx/nginx.conf.example:/etc/nginx/conf.d/selfpost.conf:ro
|
|
- ./nginx/certbot-etc:/etc/letsencrypt:ro
|
|
- ./nginx/certbot-www:/var/www/certbot:ro
|
|
|
|
certbot:
|
|
image: certbot/certbot:latest
|
|
volumes:
|
|
- ./nginx/certbot-etc:/etc/letsencrypt
|
|
- ./nginx/certbot-www:/var/www/certbot
|
|
# Renewal twice a day is certbot's own recommended cadence; it no-ops
|
|
# until a certificate is within its renewal window.
|
|
# (eff-certbot.readthedocs.io, User Guide, "Automated Renewals": the
|
|
# sample cron runs "certbot renew" at 0 and 12 h; renew acts only on a
|
|
# certificate near expiry.) The first certificate was issued --standalone
|
|
# (see the top of this file), and certbot renews with the plugin it was
|
|
# issued with "unless you specify other plugins or options" (same page,
|
|
# "Renewing certificates") - by then nginx holds port 80 and serves the
|
|
# webroot, so renewal names it; a renewal that succeeds with it saves it.
|
|
entrypoint: sh -c 'trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot; sleep 12h & wait $${!}; done'
|