mixandClaude Opus 5.5
f2ad699473
test / test (push) Canceled after 0s
C-P42. postfix-script's start-fg runs master as its child and master calls setsid() (Postfix 3.7.11, conf/postfix-script; src/master/master.c); supervisord signals the pid alone (supervisor 4.2.5, process.py, Subprocess.kill()). A stop of program postfix left master running - a restart then found "already running" - and a container stop cut Postfix off with SIGKILL. The wrapper now stays the parent of "postfix start-fg" and on TERM/INT runs "postfix stop", asking again while start-fg is still in its checks (master -t). stopwaitsecs=15. C-V6. The wrapper's give-up on the milter sockets came after the default startsecs, so it was EXITED and restarted for ever. startsecs is now MILTER_WAIT_TIMEOUT + 10, exported by the entrypoint as POSTFIX_STARTSECS and expanded by supervisord (options.py, processes_from_section(); a non-number MILTER_WAIT_TIMEOUT stops the start): a give-up is "Exited too quickly", BACKOFF, FATAL after startretries, crashexit. For those seconds after each start the program is STARTING (the healthcheck's 90 s start period covers it; the sender check counts no downtime then). C-V5. logrotate had startsecs=0, so a refused config restarted it every second for ever. startsecs=1: FATAL after startretries; crashexit reads the event's processname and leaves logrotate's FATAL on Server > Health. B-U2. "supervisorctl start" returns when a startsecs=0 program is RUNNING, not when it ends, and mapped "already started" to success. The panel now speaks supervisord's XML-RPC itself (internal/supervisor, RunOnce): startProcess without waiting, getProcessInfo until it leaves STARTING/RUNNING, exitstatus 0 or an error; a run in progress is waited out and one of its own follows. A failed reload while program postfix is not RUNNING is logged, not an error: the next master reads the files. C-V10: postfix-reload rests EXITED after a run; the e2e process check takes STOPPED or EXITED. C-P34: the dead "postfix set-permissions" branch goes - postfix check's create-missing builds the queue tree. Stand (2026-10-14, make e2e, exit 0; MILTER_WAIT_TIMEOUT=10 on the stand): new supervision_stops_postfix_and_gives_up - supervisorctl restart postfix writes postfix-script's "stopping the Postfix mail system" and leaves one master; with the panel's sockets removed, start answers "postfix: ERROR (spawn error)" (finish() sets spawnerr "Exited too quickly", onwait() reads it first) and Postfix comes up once the panel is back; a group-writable logrotate config ends FATAL with the container up; the panel's Reload configuration answers only after mail.log has "refreshing the Postfix mail system", postfix-reload EXITED. session_survives_restart sees the stop line for the container's restart. Measured: master's own "terminating on signal 15" never reaches mail.log (master TERMs its group, postlogd included, before it logs). go vet and go test ./... pass on the server (24 packages; new unit tests of RunOnce against a fake supervisord). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
113 lines
4.8 KiB
YAML
113 lines
4.8 KiB
YAML
|
|
# Hermetic e2e stand override for ../../deploy/docker-compose.yml (plan C.4).
|
|
#
|
|
# Applied as a second -f on top of the SHIPPED compose file, not a separate
|
|
# test compose — the whole point is to exercise cap_drop/cap_add/
|
|
# no-new-privileges exactly as documented, not a laxer stand-in. Run only via
|
|
# `make e2e`, which also sets --project-directory to a scratch stage
|
|
# directory so the base file's relative ./data and ./certs bind mounts land
|
|
# there instead of next to a real deployment, and -p selfpost-e2e so the
|
|
# containers/network never collide with a prod stack on the same host.
|
|
#
|
|
# `ports:` and `networks:` use the compose-spec `!override` merge tag to fully
|
|
# replace the base file's list rather than concatenate with it (the default
|
|
# merge behaviour for sequences) — otherwise the real 465/587/8080 would stay
|
|
# published here too and collide with a prod container on the same host.
|
|
# (docs.docker.com/reference/compose-file/merge/, "!override": "fully replace
|
|
# an attribute, bypassing the standard merge rules". The page names no
|
|
# minimum Compose version; the stand's own Compose is what each run uses.)
|
|
|
|
services:
|
|
selfpost:
|
|
# Crash-looping with unless-stopped makes `compose exec` fail with
|
|
# "Container is restarting" and hides the entrypoint/supervisord exit
|
|
# reason; keep the stand exited so logs stay attached to one attempt.
|
|
restart: "no"
|
|
build:
|
|
# Resolved relative to --project-directory (.stage), NOT this file's own
|
|
# directory — compose build.context paths follow the project directory,
|
|
# unlike bind-mount volume paths, which is the same reason ./data and
|
|
# ./certs above need no path here at all.
|
|
context: ../../..
|
|
dockerfile: build/Dockerfile
|
|
args:
|
|
# release.yml sets SELFPOST_E2E_VERSION to the release's X.Y.Z, so the
|
|
# image this build tags selfpost:e2e - the one release.yml then pushes -
|
|
# carries the release's version, not "e2e". A local `make e2e` leaves it
|
|
# unset. The suite checks the stamp (image_stamped_with_version).
|
|
VERSION: ${SELFPOST_E2E_VERSION:-e2e}
|
|
image: selfpost:e2e
|
|
environment:
|
|
SELFPOST_HOSTNAME: mail.e2e.test
|
|
# Plain HTTP panel for the test client — no reverse proxy in this stand.
|
|
PANEL_COOKIE_SECURE: "false"
|
|
# The panel's deliverability checks query resolvers directly rather than
|
|
# the container's own (see internal/dnscheck), so the fake zone has to be
|
|
# named here too — `dns:` below only redirects the system resolver.
|
|
SELFPOST_DNS_RESOLVERS: 10.77.0.10:53
|
|
# High enough that the whole suite's other ~10 sends (positive path,
|
|
# level-2 test, the various rejected attempts) never trip it by
|
|
# accident — only the dedicated level-1 test (negative check 4, which
|
|
# loops well past this count) is meant to hit it.
|
|
RATE_LIMIT_MESSAGES_PER_IP: "50"
|
|
RATE_LIMIT_WINDOW_SECONDS: "60"
|
|
# cert-reload compares the mounted certificate with Postfix's copy this
|
|
# often, so renewed_certificate_picked_up does not wait a day. It
|
|
# reloads Postfix only when the certificate changed.
|
|
TLS_RELOAD_INTERVAL_SECONDS: "2"
|
|
# The wrapper gives up on the milter sockets after this long, and
|
|
# program postfix's startsecs is this plus ten (build/entrypoint.sh):
|
|
# supervision_stops_postfix_and_gives_up waits for one give-up and
|
|
# every start for startsecs, so the stand keeps both short.
|
|
MILTER_WAIT_TIMEOUT: "10"
|
|
ports: !override
|
|
- "20465:465"
|
|
- "20587:587"
|
|
- "20025:25"
|
|
- "127.0.0.1:20080:8080"
|
|
dns:
|
|
- 10.77.0.10
|
|
networks: !override
|
|
e2e:
|
|
depends_on:
|
|
- coredns
|
|
- sink
|
|
|
|
# Fake authoritative DNS for e2e.test (plan C.4): serves the DKIM/host
|
|
# records the test harness publishes, so Postfix's outbound MX lookup for
|
|
# the sink and the panel's own dnscheck resolve inside the isolated network
|
|
# instead of hitting the real internet.
|
|
#
|
|
# Pinned to a release tag rather than `latest`, so a CoreDNS upload cannot
|
|
# change what the release gate runs against between two runs of the same
|
|
# commit. Not a digest: the tag is a multi-arch manifest and the stand has to
|
|
# come up on arm64 developer machines as well as amd64 CI.
|
|
coredns:
|
|
image: coredns/coredns:1.14.6
|
|
command: ["-conf", "/dns/Corefile"]
|
|
volumes:
|
|
- ./dns-stage:/dns
|
|
networks:
|
|
e2e:
|
|
ipv4_address: 10.77.0.10
|
|
ports:
|
|
- "20053:53/udp"
|
|
|
|
# Sink-MX: accepts any inbound mail and dumps each transaction to its own
|
|
# file under ./mail-stage, which the harness reads directly to check the
|
|
# DKIM-Signature header Postfix/OpenDKIM produced.
|
|
sink:
|
|
build:
|
|
context: ../sink
|
|
volumes:
|
|
- ./mail-stage:/mail
|
|
networks:
|
|
e2e:
|
|
ipv4_address: 10.77.0.11
|
|
|
|
networks:
|
|
e2e:
|
|
ipam:
|
|
config:
|
|
- subnet: 10.77.0.0/24
|