mixandClaude Opus 5.5
f2ad699473
test / test (push) Canceled after 0s
C-P42. postfix-script's start-fg runs master as its child and master calls setsid() (Postfix 3.7.11, conf/postfix-script; src/master/master.c); supervisord signals the pid alone (supervisor 4.2.5, process.py, Subprocess.kill()). A stop of program postfix left master running - a restart then found "already running" - and a container stop cut Postfix off with SIGKILL. The wrapper now stays the parent of "postfix start-fg" and on TERM/INT runs "postfix stop", asking again while start-fg is still in its checks (master -t). stopwaitsecs=15. C-V6. The wrapper's give-up on the milter sockets came after the default startsecs, so it was EXITED and restarted for ever. startsecs is now MILTER_WAIT_TIMEOUT + 10, exported by the entrypoint as POSTFIX_STARTSECS and expanded by supervisord (options.py, processes_from_section(); a non-number MILTER_WAIT_TIMEOUT stops the start): a give-up is "Exited too quickly", BACKOFF, FATAL after startretries, crashexit. For those seconds after each start the program is STARTING (the healthcheck's 90 s start period covers it; the sender check counts no downtime then). C-V5. logrotate had startsecs=0, so a refused config restarted it every second for ever. startsecs=1: FATAL after startretries; crashexit reads the event's processname and leaves logrotate's FATAL on Server > Health. B-U2. "supervisorctl start" returns when a startsecs=0 program is RUNNING, not when it ends, and mapped "already started" to success. The panel now speaks supervisord's XML-RPC itself (internal/supervisor, RunOnce): startProcess without waiting, getProcessInfo until it leaves STARTING/RUNNING, exitstatus 0 or an error; a run in progress is waited out and one of its own follows. A failed reload while program postfix is not RUNNING is logged, not an error: the next master reads the files. C-V10: postfix-reload rests EXITED after a run; the e2e process check takes STOPPED or EXITED. C-P34: the dead "postfix set-permissions" branch goes - postfix check's create-missing builds the queue tree. Stand (2026-10-14, make e2e, exit 0; MILTER_WAIT_TIMEOUT=10 on the stand): new supervision_stops_postfix_and_gives_up - supervisorctl restart postfix writes postfix-script's "stopping the Postfix mail system" and leaves one master; with the panel's sockets removed, start answers "postfix: ERROR (spawn error)" (finish() sets spawnerr "Exited too quickly", onwait() reads it first) and Postfix comes up once the panel is back; a group-writable logrotate config ends FATAL with the container up; the panel's Reload configuration answers only after mail.log has "refreshing the Postfix mail system", postfix-reload EXITED. session_survives_restart sees the stop line for the container's restart. Measured: master's own "terminating on signal 15" never reaches mail.log (master TERMs its group, postlogd included, before it logs). go vet and go test ./... pass on the server (24 packages; new unit tests of RunOnce against a fake supervisord). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
88 lines
3.8 KiB
Bash
88 lines
3.8 KiB
Bash
#!/bin/sh
|
|
# Postfix start wrapper: solves the cold-start race where Postfix would try to
|
|
# reach the milter sockets before they are listening.
|
|
#
|
|
# It blocks until the milter sockets — OpenDKIM, the panel's sender check and
|
|
# journal-milter and, with the inbound relay on, its inbound journal milter —
|
|
# are present, then runs `postfix start-fg` and stays its parent. If they are
|
|
# not ready within the timeout it exits non-zero WITHOUT starting Postfix.
|
|
# supervisord counts that exit as one that came too quickly - the program's
|
|
# startsecs is the timeout plus ten seconds (build/entrypoint.sh) - so after
|
|
# startretries it is FATAL and crashexit takes the container down, instead of
|
|
# a relay running blind (supervisor 4.2.5, supervisor/process.py,
|
|
# Subprocess.finish(): an exit before startsecs is "Exited too quickly" and
|
|
# goes to BACKOFF; transition(): BACKOFF past startretries is FATAL;
|
|
# assumptions C-V6).
|
|
#
|
|
# This handles cold start only. Once Postfix runs, a milter that does not
|
|
# answer costs what its default_action says (build/postfix-config.sh): mail is
|
|
# deferred for OpenDKIM and the sender check, and passes the journal-milter.
|
|
set -eu
|
|
|
|
OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
|
|
JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
|
|
SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
|
|
TIMEOUT="${MILTER_WAIT_TIMEOUT:-30}"
|
|
INTERVAL=1
|
|
|
|
SOCKS="$OPENDKIM_SOCK $JOURNAL_SOCK $SENDER_SOCK"
|
|
if [ "${INBOUND_RELAY_ENABLE:-false}" = "true" ]; then
|
|
SOCKS="$SOCKS ${INBOUND_JOURNAL_MILTER_SOCKET:-/run/selfpost/inbound-journal.sock}"
|
|
fi
|
|
|
|
elapsed=0
|
|
for sock in $SOCKS; do
|
|
while [ ! -S "$sock" ]; do
|
|
if [ "$elapsed" -ge "$TIMEOUT" ]; then
|
|
echo "postfix-wrapper: timed out after ${TIMEOUT}s waiting for milter socket $sock" >&2
|
|
exit 1
|
|
fi
|
|
sleep "$INTERVAL"
|
|
elapsed=$((elapsed + INTERVAL))
|
|
done
|
|
echo "postfix-wrapper: milter socket ready: $sock"
|
|
done
|
|
|
|
echo "postfix-wrapper: milter sockets ready, starting postfix"
|
|
# Postfix 3.7.11: postfix(1) execs conf/postfix-script (src/postfix/postfix.c),
|
|
# whose "start-fg" execs master only as PID 1 and otherwise runs "master -s" as
|
|
# its child; master then makes itself a session leader (src/master/master.c,
|
|
# setsid()). A signal supervisord sends this program never reaches master
|
|
# (supervisor 4.2.5, supervisor/process.py, Subprocess.kill(): to the pid
|
|
# alone without stopasgroup, and master is not in its group anyway): before,
|
|
# a stop left master running - a restart of the program then found Postfix
|
|
# "already running", and a stop of the container cut Postfix off with
|
|
# SIGKILL (assumptions C-P42). So this shell stays, and on TERM or INT runs
|
|
# "postfix stop" (conf/postfix-script, "stop": TERM to master, then waits up
|
|
# to five seconds and kills its group; src/master/master_sig.c,
|
|
# master_sigdeath(): "terminating on signal 15").
|
|
#
|
|
# "postfix start-fg" spends its first seconds in its checks before master
|
|
# runs; a stop asked then would find nothing to stop, so it is asked again
|
|
# until the child is gone. "master -t" exits 0, silently, while no master
|
|
# holds the lock (src/master/master.c, test_lock).
|
|
daemon_directory=$(postconf -h daemon_directory)
|
|
child=
|
|
stop_postfix() {
|
|
trap '' TERM INT
|
|
while [ -n "$child" ] && kill -0 "$child" 2>/dev/null; do
|
|
if "$daemon_directory/master" -t 2>/dev/null; then
|
|
sleep 1
|
|
else
|
|
postfix stop || true
|
|
fi
|
|
done
|
|
exit 0
|
|
}
|
|
trap stop_postfix TERM INT
|
|
postfix start-fg &
|
|
child=$!
|
|
# A trapped signal makes wait return at once, the trap is taken right after
|
|
# (POSIX, Shell Command Language, 2.11 Signals and Error Handling) and exits.
|
|
# Otherwise wait returns when Postfix ended on its own: its status is this
|
|
# program's, and supervisord restarts it.
|
|
status=0
|
|
wait "$child" || status=$?
|
|
echo "postfix-wrapper: postfix exited with status $status" >&2
|
|
exit "$status"
|