mixandClaude Opus 5.5
faa3c11ae7
test / test (push) Waiting to run
The panel's signer is the only one. Gone: the opendkim package and its
configuration, the syslog-relay and opendkim programs, /dev/log and
/run/opendkim, the reload by USR1 through supervisord
(internal/supervisor/supervisor.go), internal/syslogrelay, the port of
OpenDKIM's From: parser (internal/milter/mailparse.go and its probe,
harness and test/upstream scripts), OPENDKIM_SOCKET and OPENDKIM_DIR.
Keys: internal/domain/keys.go (Keys, NewKeys, DKIM_DIR=/data/dkim) keeps
the keys and writes a selector table, /data/dkim/selectors ("<name>
<selector>"), which the signer reads in place of the KeyTable - it reads
no database, as the sender check reads none. The table is written before
the signer serves (EnsureServerSigned moved there from the notifier).
Keys and table 0600, directories 0700, the panel's. The entrypoint copies
/data/opendkim/keys once, as the panel user, into /data/dkim.new renamed
when whole, and stops the start if the copy fails; /data/opendkim is left
for a rollback to 2.7.x.
Sender check: one RFC 5322 address as a mail program reads it, held
against the bindings; the 256-byte refusal and the texts naming OpenDKIM
go. Allowed() folded the domain through strings.ToLower, which makes the
Kelvin sign a "k" - the comparison with OpenDKIM's reading had hidden it;
it folds ASCII only now.
Health: two dkim-signer rows (applications, notifications) in Milter
sockets, opendkim out of the liveness set; the card no longer takes any
row with a note for the spam filter. Texts as in the design commit.
KILL stays in deploy/docker-compose.yml: measured on the test server,
root without it cannot signal a process of another uid - supervisord
stopping the panel, Postfix's master its children. The plan's "only use
was the reload" was wrong; the comment now gives the real uses.
e2e: one signature, the panel's, verified by dkimpy; the /data/dkim modes;
the OpenDKIM log and process checks, testNeverSignedForAnother and the
cited opendkim, libopendkim11 and libmilter1.0.1 go.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
113 lines
4.8 KiB
Bash
113 lines
4.8 KiB
Bash
#!/bin/sh
|
|
# Postfix start wrapper: solves the cold-start race where Postfix would try to
|
|
# reach the milter sockets before they are listening.
|
|
#
|
|
# It blocks until the milter sockets — the panel's sender check, DKIM signer
|
|
# (two) and journal-milter and, with the inbound relay on, its
|
|
# inbound journal milter —
|
|
# are present, then runs `postfix start-fg` and stays its parent. If they are
|
|
# not ready within the timeout it exits non-zero WITHOUT starting Postfix.
|
|
# supervisord counts that exit as one that came too quickly - the program's
|
|
# startsecs is the timeout plus ten seconds (build/entrypoint.sh) - so after
|
|
# startretries it is FATAL and crashexit takes the container down, instead of
|
|
# a relay running blind (supervisor 4.2.5, supervisor/process.py,
|
|
# Subprocess.finish(): an exit before startsecs is "Exited too quickly" and
|
|
# goes to BACKOFF; transition(): BACKOFF past startretries is FATAL;
|
|
# assumptions C-V6).
|
|
#
|
|
# This handles cold start only. Once Postfix runs, a milter that does not
|
|
# answer costs what its default_action says (build/postfix-config.sh): mail is
|
|
# deferred for the signer and the sender check, and passes the journal-milter.
|
|
set -eu
|
|
|
|
JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
|
|
SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
|
|
SIGN_SOCK="${DKIM_SIGN_SOCKET:-/run/selfpost/sign.sock}"
|
|
SIGN_LOCAL_SOCK="${DKIM_SIGN_LOCAL_SOCKET:-/run/selfpost/sign-local.sock}"
|
|
TIMEOUT="${MILTER_WAIT_TIMEOUT:-30}"
|
|
INTERVAL=1
|
|
|
|
SOCKS="$JOURNAL_SOCK $SENDER_SOCK $SIGN_SOCK $SIGN_LOCAL_SOCK"
|
|
if [ "${INBOUND_RELAY_ENABLE:-false}" = "true" ]; then
|
|
SOCKS="$SOCKS ${INBOUND_JOURNAL_MILTER_SOCKET:-/run/selfpost/inbound-journal.sock}"
|
|
fi
|
|
|
|
elapsed=0
|
|
for sock in $SOCKS; do
|
|
while [ ! -S "$sock" ]; do
|
|
if [ "$elapsed" -ge "$TIMEOUT" ]; then
|
|
echo "postfix-wrapper: timed out after ${TIMEOUT}s waiting for milter socket $sock" >&2
|
|
exit 1
|
|
fi
|
|
sleep "$INTERVAL"
|
|
elapsed=$((elapsed + INTERVAL))
|
|
done
|
|
echo "postfix-wrapper: milter socket ready: $sock"
|
|
done
|
|
|
|
echo "postfix-wrapper: milter sockets ready, starting postfix"
|
|
# Postfix 3.10.13: postfix(1) execs conf/postfix-script (src/postfix/postfix.c:669),
|
|
# whose "start-fg" (:200-210) execs master only as PID 1 and otherwise runs
|
|
# "master -s" as its child; master then makes itself a session leader
|
|
# (src/master/master.c:441, setsid()). A signal supervisord sends this
|
|
# program never reaches master
|
|
# (supervisor 4.2.5, supervisor/process.py, Subprocess.kill(): to the pid
|
|
# alone without stopasgroup, and master is not in its group anyway): before,
|
|
# a stop left master running - a restart of the program then found Postfix
|
|
# "already running", and a stop of the container cut Postfix off with
|
|
# SIGKILL (assumptions C-P42). So this shell stays, and on TERM or INT runs
|
|
# "postfix stop" (conf/postfix-script:237-253, "stop": TERM to master, then
|
|
# waits up to five seconds and kills its group; src/master/master_sig.c:205,
|
|
# master_sigdeath(): "terminating on signal 15"). Debian's redirect of
|
|
# "postfix start" to systemd (debian/patches/
|
|
# debian-re-run-startup-through-systemd.patch, conf/postfix-script:170-189)
|
|
# leaves start-fg alone and needs /run/systemd/system, which this container
|
|
# has not.
|
|
#
|
|
# Since Postfix 3.8 postfix(1) and postlog(1) - postfix-script's $INFO, $WARN
|
|
# and $FATAL - write their messages to stderr even when it is not a terminal
|
|
# (src/postfix/postfix.c:546, msg_vstream_init() no longer under isatty();
|
|
# RELEASE_NOTES-3.8:114-115, [Incompat 20230308]), besides maillog_file. So
|
|
# "starting the Postfix mail system", "stopping ..." and check-warn's
|
|
# warnings now reach the container's log through this program's stderr
|
|
# (build/supervisord.conf) as well as /data/log/mail.log; nothing reads them
|
|
# there but a person.
|
|
#
|
|
# "postfix start-fg" spends its first seconds in its checks before master
|
|
# runs; a stop asked then would find nothing to stop, so it is asked again
|
|
# until the child is gone. "master -t" exits 0, silently, while no master
|
|
# holds the lock (src/master/master.c:495-499, test_lock).
|
|
daemon_directory=$(postconf -h daemon_directory)
|
|
child=
|
|
stop_asked=
|
|
stop_postfix() {
|
|
if [ -z "$child" ]; then
|
|
# Between "&" and "child=$!": stopped right after the pid is known.
|
|
stop_asked=1
|
|
return
|
|
fi
|
|
trap '' TERM INT
|
|
while kill -0 "$child" 2>/dev/null; do
|
|
if "$daemon_directory/master" -t 2>/dev/null; then
|
|
sleep 1
|
|
else
|
|
postfix stop || true
|
|
fi
|
|
done
|
|
exit 0
|
|
}
|
|
trap stop_postfix TERM INT
|
|
postfix start-fg &
|
|
child=$!
|
|
if [ -n "$stop_asked" ]; then
|
|
stop_postfix
|
|
fi
|
|
# A trapped signal makes wait return at once, the trap is taken right after
|
|
# (POSIX, Shell Command Language, 2.11 Signals and Error Handling) and exits.
|
|
# Otherwise wait returns when Postfix ended on its own: its status is this
|
|
# program's, and supervisord restarts it.
|
|
status=0
|
|
wait "$child" || status=$?
|
|
echo "postfix-wrapper: postfix exited with status $status" >&2
|
|
exit "$status"
|