mixandClaude Opus 5.5
50fd6b859f
internal/notify applies the owner's rules. Each subject has a row of state, so a thing is said once and a restart says nothing again: - DNS of a sending domain: said after two hourly checks in a row found a record wrong, said to be over after two found it right. A lookup that did not answer moves nothing; a warning (no DMARC record) is not a subject. - TLS certificate: at 14 days and at 3, per certificate. - Queue: a message older than three days, once; once more when none is. - Level-2 limit: from the rejected rows of the send log, every five minutes; at most once a day per domain and application. Global users are told everything, domain users about their domains; one message per recipient. With the instance switch off nothing is checked and no state moves. A message that could not be handed to Postfix is tried again at the next check. Mail leaves by sendmail(1) as postmaster@<hostname>, addresses after "--", no shell. For it to be believed the server's own name is signed like a sending domain: domain.Service keeps a key for it and a line in OpenDKIM's tables without a registry row, and non_smtpd_milters now names OpenDKIM. A sending domain of the same name shares its key with the server. dnscheck.ServerMail checks the name's DKIM and SPF records; postfix.QueueMessages reads postqueue -j for arrival times. The notifier is a sixth role of the panel process. Nothing in the panel shows or switches it yet. Checked on Windows: go vet clean; go test passes for notify, store, postfix, dnscheck, cmd, and domain apart from TestWriteLoadPrivateKeyRoundtrip, which fails there on file modes and always did. Not yet run in a container: whether the unprivileged panel may submit is for the e2e step. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
1.4 KiB
Go
43 lines
1.4 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/mixeme/selfpost/internal/dnscheck"
|
|
"github.com/mixeme/selfpost/internal/health"
|
|
"github.com/mixeme/selfpost/internal/notify"
|
|
"github.com/mixeme/selfpost/internal/postfix"
|
|
"github.com/mixeme/selfpost/internal/store"
|
|
)
|
|
|
|
// runNotifier writes to the panel's users when something needs them
|
|
// (architecture.md § Notifications), until ctx is cancelled. It reads what the
|
|
// pages read - a domain's published records against the key this server signs
|
|
// with, the certificate file, Postfix's queue - with a DNS checker of its own,
|
|
// so that its hourly look is never a page's cached one.
|
|
func runNotifier(ctx context.Context, cfg config, st *store.Store) error {
|
|
ms := newMailStack(cfg, st)
|
|
dns := dnscheck.New(cfg.dnsResolvers)
|
|
|
|
n := notify.New(st, notify.Checks{
|
|
Domain: func(d store.Domain) (dnscheck.Domain, error) {
|
|
rec, err := ms.Domains.DKIMRecord(d)
|
|
if err != nil {
|
|
return dnscheck.Domain{}, err
|
|
}
|
|
srv := dns.Server(cfg.hostname, true)
|
|
return dns.Domain(dnscheck.Query{
|
|
Name: d.Name,
|
|
Selector: d.DKIMSelector,
|
|
ExpectedDKIM: rec.Value,
|
|
Hostname: srv.Hostname,
|
|
ServerIPs: srv.IPs,
|
|
DMARCReportEmail: d.DMARCRua,
|
|
}, true), nil
|
|
},
|
|
Certificate: func() health.Certificate { return health.CheckCertificate(cfg.tlsCertFile) },
|
|
Queue: postfix.QueueMessages,
|
|
}, notify.NewMailer(cfg.hostname), cfg.hostname)
|
|
return n.Run(ctx)
|
|
}
|