mixandClaude Opus 5.5
ce363f48dd
Comments only, no behaviour changed. Each place the log tailer, Health and cmd/panel rely on another program now says where that is written, for the version the image runs: Postfix 3.7.11 (log_adhoc(), msg_logger_print(), smtpd_whatsup(), cleanup_milter.c, qmgr_active.c, postlogd.c, showq.c, pipe.c), logrotate 3.21.0, supervisor 4.2.5, proc(5). Measurements stay measurements and say where and when; test fixtures say whether they were seen or composed. Where the source contradicts the code the comment does not bless it but names the register entry (A-8 expiry, A-12 the ISO stamp no Postfix writes, A-15 the last recipient, A-21/A-23 sasl_username, A-33 postlogd's old inode, A-38 a socket file is not a listener, A-65 the certificate served); those are fixed in their own commits. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
81 lines
2.9 KiB
Go
81 lines
2.9 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"log"
|
|
"net"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"github.com/mixeme/selfpost/internal/inbound"
|
|
"github.com/mixeme/selfpost/internal/milter"
|
|
"github.com/mixeme/selfpost/internal/store"
|
|
)
|
|
|
|
// serveJournal opens the journal-milter Unix socket and runs the real milter
|
|
// (architecture.md § Mail path), recording accepted messages into the send
|
|
// log. Socket lifecycle (creation, stale cleanup, group permissions) lives
|
|
// in listenMilter; the protocol handler lives in internal/milter.
|
|
func serveJournal(ctx context.Context, cfg config, st *store.Store) error {
|
|
ln, err := listenMilter(cfg.journalSocket)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
log.Printf("journal-milter listening on %s", cfg.journalSocket)
|
|
return milter.Serve(ctx, ln, st)
|
|
}
|
|
|
|
// serveInboundJournal runs the inbound journal milter, the last milter on
|
|
// port 25 (internal/milter/inbound.go). It exists only while the inbound relay
|
|
// is on: build/postfix-config.sh attaches the socket under the same condition.
|
|
func serveInboundJournal(ctx context.Context, cfg config, st *store.Store) error {
|
|
ln, err := listenMilter(cfg.inboundJournalSocket)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// With a filter attached, the key it signs with. Without the key no
|
|
// verdict can be told from a sender's own, so none is read: the journal
|
|
// still records the mail, and the log says why it shows no verdicts.
|
|
key := ""
|
|
if cfg.inboundAntispamMilter != "" {
|
|
if key, err = inbound.FilterKey(cfg.antispamDir); err != nil {
|
|
log.Printf("inbound-journal-milter: no key for the filter's signature, verdicts will not be recorded: %v", err)
|
|
key = ""
|
|
}
|
|
}
|
|
log.Printf("inbound-journal-milter listening on %s", cfg.inboundJournalSocket)
|
|
return milter.ServeInbound(ctx, ln, st, key)
|
|
}
|
|
|
|
// listenMilter opens a milter's Unix socket where Postfix can reach it.
|
|
func listenMilter(socketPath string) (net.Listener, error) {
|
|
if err := os.MkdirAll(filepath.Dir(socketPath), 0o755); err != nil {
|
|
return nil, err
|
|
}
|
|
// Clear a stale socket left behind by an unclean shutdown, otherwise the
|
|
// listen below fails with "address already in use" (unix(7): the socket
|
|
// file "must be deleted by the caller when it is no longer needed"; bind(2)
|
|
// EADDRINUSE).
|
|
if err := os.Remove(socketPath); err != nil && !errors.Is(err, os.ErrNotExist) {
|
|
return nil, err
|
|
}
|
|
|
|
ln, err := net.Listen("unix", socketPath)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
// Postfix (user `postfix`) connects to this socket as a milter and needs
|
|
// group access. The socket inherits group `selfpost` from the setgid parent
|
|
// dir entrypoint.sh prepares; make it group read/write so postfix can reach
|
|
// it (connecting to a Unix socket needs write permission on the node).
|
|
// unix(7): "connecting to a stream socket object requires write
|
|
// permission on that socket"; inode(7): a file made in a set-group-ID
|
|
// directory takes the directory's group.
|
|
if err := os.Chmod(socketPath, 0o660); err != nil {
|
|
ln.Close()
|
|
return nil, err
|
|
}
|
|
return ln, nil
|
|
}
|