@wtfalch/foundry 0.34.0 → 0.35.1

package/dist/plan/mail-relay.d.ts

@@ -13,35 +13,52 @@ import type { CoolifyPort } from './executor.js';
  * Everything it knows reaches the container as env the step writes.
  */
 export declare const PLATFORM_MAIL_RELAY_KEY = "platform:mail-relay";
-/** Fingerprint of the sorted routes and platform domains the last successful apply put live. */
+/** Fingerprint of the sorted routes the last successful apply put live. */
 export declare const PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY = "mail_relay_routes_applied";
-/** The base image tag the last successful apply built the relay from. */
-export declare const PLATFORM_MAIL_RELAY_BASE_SCOPE_KEY = "mail_relay_base_applied";
-/** The org-applied-state key the company mail step records its server's SMTP address under (`<internal name>:25`). */
+/**
+ * Fingerprint of what forces an image rebuild (the Dockerfile text, which holds
+ * the base image pin) and the spool volume the last successful apply put live.
+ * A routes change leaves it alone, so it restarts the container and rebuilds nothing.
+ */
+export declare const PLATFORM_MAIL_RELAY_BUILD_SCOPE_KEY = "mail_relay_build_applied";
+/** Postfix's queue. On a volume, so mail not yet handed on survives a restart and a rebuild. */
+export declare const MAIL_RELAY_SPOOL_DIR = "/var/spool/postfix";
+export declare const MAIL_RELAY_SPOOL_VOLUME = "platform-mail-relay-spool";
+/**
+ * The org-applied-state key the company mail step records its server's SMTP address under: `<server address>:<port>`,
+ * the port the company's Stalwart publishes on the server for the relay ({@link OWN_MAIL_SMTP_PORT_SCOPE_KEY}).
+ * The relay is on the platform's network and a company's mail server on the company's own, so the relay
+ * reaches it through the server, not by its container name.
+ */
 export declare const OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY = "mail_smtp_internal";
+/** The host port a company's Stalwart publishes (mapped to its port 25) for the relay. */
+export declare const OWN_MAIL_SMTP_PORT_SCOPE_KEY = "mail_smtp_port";
+/** The host ports companies' mail servers take, one each: the lowest free one in this range. */
+export declare const OWN_MAIL_SMTP_PORT_BASE = 25000;
+export declare const OWN_MAIL_SMTP_PORT_MAX = 25999;
+/** Whether `port` is one of the ports a company's mail server may publish. */
+export declare function isOwnMailSmtpPort(port: unknown): port is number;
 export declare const MAIL_RELAY_APP_NAME = "platform-mail-relay";
-/** One recipient domain and the mail server that receives it: `target` is `<internal name>:25`. */
+/** One recipient domain and the mail server that receives it: `target` is `<host>:<port>`. */
 export interface MailRoute {
     domain: string;
     target: string;
 }
 /** Lower-cases and checks a recipient domain; `null` for anything that is not a plain DNS name. */
 export declare function normalizeMailDomain(domain: string): string | null;
-/** Lower-cases and checks `<host>:25`; `null` for whitespace, metacharacters, another port or no host. */
+/** Lower-cases and checks `<host>:<port>`; `null` for whitespace, metacharacters, a port outside 1..65535 or no host. */
 export declare function normalizeMailTarget(target: string): string | null;
 /**
  * The routes, checked and sorted by domain. `null` when any entry is invalid or
  * one domain has two targets (a message could not know where to go).
  */
 export declare function normalizeMailRoutes(routes: readonly MailRoute[]): MailRoute[] | null;
-/** The platform's own mail domains, checked, de-duplicated, sorted; `null` when any is invalid. */
-export declare function normalizeMailDomains(domains: readonly string[]): string[] | null;
 /**
  * What the relay was last built to do, as one value. Order of the inputs does
- * not matter; a changed target, a new route or a new platform domain does.
+ * not matter; a changed target or a new route does.
  * Never empty, so a platform with no company route still records one.
  */
-export declare function mailRelayFingerprint(routes: readonly MailRoute[], platformDomains: readonly string[]): string;
+export declare function mailRelayFingerprint(routes: readonly MailRoute[]): string;
 /**
  * The relay's container start script. It renders Postfix's config from env
  * only and refuses to start on a value that is not a plain domain or host, so
@@ -49,31 +66,30 @@ export declare function mailRelayFingerprint(routes: readonly MailRoute[], platf
  * the listed domains and nothing else (`reject_unauth_destination`), so it
  * cannot be used to send to a third party.
  *
- * Env: `MAIL_RELAY_HOSTNAME`, `MAIL_RELAY_DEFAULT_TARGET` (the platform
- * Stalwart, `<name>:25`), `MAIL_RELAY_ROUTES` (`domain=host:25`, comma
- * separated), `MAIL_RELAY_PLATFORM_DOMAINS` (comma separated, delivered to the
- * default target). `MAIL_RELAY_RENDER_ONLY=1` writes the files and stops, and
+ * Mail for a domain no company routes is refused: there is no platform mail
+ * server to fall back on, so no default target exists.
+ *
+ * Env: `MAIL_RELAY_HOSTNAME`, `MAIL_RELAY_ROUTES` (`domain=host:port`, comma
+ * separated). `MAIL_RELAY_RENDER_ONLY=1` writes the files and stops, and
  * `MAIL_RELAY_CONF_DIR` moves them; both are for tests.
  */
-export declare const MAIL_RELAY_ENTRYPOINT = "#!/bin/sh\nset -eu\nset -f\nconf=\"${MAIL_RELAY_CONF_DIR:-/etc/postfix}\"\nfail() { echo \"mail relay: $1\" >&2; exit 1; }\nok_name() {\n  case \"$1\" in\n    ''|*[!a-z0-9.-]*|.*|*.|*..*|-*|*.-*|*-.*) return 1 ;;\n  esac\n  return 0\n}\nok_domain() { ok_name \"$1\" && case \"$1\" in *.*) return 0 ;; esac; return 1; }\nok_target() {\n  case \"$1\" in *:25) ;; *) return 1 ;; esac\n  ok_name \"${1%:25}\"\n}\nok_target \"${MAIL_RELAY_DEFAULT_TARGET:-}\" || fail \"MAIL_RELAY_DEFAULT_TARGET is not <host>:25\"\nok_name \"${MAIL_RELAY_HOSTNAME:-}\" || fail \"MAIL_RELAY_HOSTNAME is not a host name\"\n: > \"$conf/relay_domains\"\n: > \"$conf/transport\"\nIFS=','\nfor entry in ${MAIL_RELAY_ROUTES:-}; do\n  d=\"${entry%%=*}\"\n  t=\"${entry#*=}\"\n  ok_domain \"$d\" || fail \"a route domain is not a plain domain\"\n  ok_target \"$t\" || fail \"a route target is not <host>:25\"\n  printf '%s OK\\n' \"$d\" >> \"$conf/relay_domains\"\n  printf '%s smtp:[%s]:25\\n' \"$d\" \"${t%:25}\" >> \"$conf/transport\"\ndone\nfor d in ${MAIL_RELAY_PLATFORM_DOMAINS:-}; do\n  ok_domain \"$d\" || fail \"a platform domain is not a plain domain\"\n  printf '%s OK\\n' \"$d\" >> \"$conf/relay_domains\"\n  printf '%s smtp:[%s]:25\\n' \"$d\" \"${MAIL_RELAY_DEFAULT_TARGET%:25}\" >> \"$conf/transport\"\ndone\nunset IFS\ncat > \"$conf/main.cf\" <<CONF\nmyhostname = $MAIL_RELAY_HOSTNAME\nmyorigin = \\$myhostname\ninet_interfaces = all\ninet_protocols = ipv4\nmydestination =\nmynetworks = 127.0.0.0/8\nlocal_recipient_maps =\nalias_maps =\nalias_database =\nrelay_domains = texthash:$conf/relay_domains\ntransport_maps = texthash:$conf/transport\nrelay_recipient_maps =\nsmtpd_relay_restrictions = reject_unauth_destination\nsmtpd_recipient_restrictions = reject_unauth_destination\ndisable_vrfy_command = yes\nmaillog_file = /dev/stdout\nCONF\n[ \"${MAIL_RELAY_RENDER_ONLY:-}\" = \"1\" ] && exit 0\nexec postfix start-fg\n";
+export declare const MAIL_RELAY_ENTRYPOINT = "#!/bin/sh\nset -eu\nset -f\nconf=\"${MAIL_RELAY_CONF_DIR:-/etc/postfix}\"\nfail() { echo \"mail relay: $1\" >&2; exit 1; }\nok_name() {\n  case \"$1\" in\n    ''|*[!a-z0-9.-]*|.*|*.|*..*|-*|*.-*|*-.*) return 1 ;;\n  esac\n  return 0\n}\nok_domain() { ok_name \"$1\" && case \"$1\" in *.*) return 0 ;; esac; return 1; }\nok_target() {\n  h=\"${1%:*}\"\n  p=\"${1##*:}\"\n  [ \"$h\" != \"$1\" ] || return 1\n  case \"$p\" in ''|0*|*[!0-9]*) return 1 ;; esac\n  [ \"${#p}\" -le 5 ] || return 1\n  [ \"$p\" -le 65535 ] || return 1\n  ok_name \"$h\"\n}\nok_name \"${MAIL_RELAY_HOSTNAME:-}\" || fail \"MAIL_RELAY_HOSTNAME is not a host name\"\n: > \"$conf/relay_domains\"\n: > \"$conf/transport\"\nIFS=','\nfor entry in ${MAIL_RELAY_ROUTES:-}; do\n  d=\"${entry%%=*}\"\n  t=\"${entry#*=}\"\n  ok_domain \"$d\" || fail \"a route domain is not a plain domain\"\n  ok_target \"$t\" || fail \"a route target is not <host>:<port>\"\n  printf '%s OK\\n' \"$d\" >> \"$conf/relay_domains\"\n  printf '%s smtp:[%s]:%s\\n' \"$d\" \"${t%:*}\" \"${t##*:}\" >> \"$conf/transport\"\ndone\nunset IFS\ncat > \"$conf/main.cf\" <<CONF\nmyhostname = $MAIL_RELAY_HOSTNAME\nmyorigin = \\$myhostname\ninet_interfaces = all\ninet_protocols = ipv4\nmydestination =\nmynetworks = 127.0.0.0/8\nlocal_recipient_maps =\nalias_maps =\nalias_database =\nrelay_domains = texthash:$conf/relay_domains\nparent_domain_matches_subdomains =\ntransport_maps = texthash:$conf/transport\nrelay_recipient_maps =\nsmtpd_relay_restrictions = reject_unauth_destination\nsmtpd_recipient_restrictions = reject_unauth_destination\ndisable_vrfy_command = yes\nmaillog_file = /dev/stdout\nCONF\n[ \"${MAIL_RELAY_RENDER_ONLY:-}\" = \"1\" ] && exit 0\nexec postfix start-fg\n";
 /** The inline Dockerfile Coolify builds. The start script travels base64-encoded so no quoting can alter it. */
 export declare function mailRelayDockerfile(): string;
+/** What a rebuild depends on: the Dockerfile and the spool mount. Routes, domains and hostname are not in it. */
+export declare function mailRelayBuildFingerprint(): string;
 /** The env the step writes; the only input the container reads. */
 export declare function mailRelayEnv(input: {
     hostname: string;
-    defaultTarget: string;
     routes: readonly MailRoute[];
-    platformDomains: readonly string[];
 }): Array<{
     key: string;
     value: string;
     literal: boolean;
 }>;
 export declare const MAIL_RELAY_BLOCKED: {
-    readonly mailNotEnabled: "the platform's mail relay is blocked, not planned: the platform's mail server is not enabled";
-    readonly mailNotReady: "the platform's mail relay is blocked, not planned: the platform's mail server is neither applied nor planned";
     readonly executorMissing: "the platform's mail relay is blocked, not planned: the host built the platform executor without its mail dependencies";
-    readonly invalidRoutes: "the platform's mail relay is blocked, not planned: a mail route or platform mail domain is not valid (a domain must be a plain DNS name, a target must be <host>:25, one domain needs one target)";
+    readonly invalidRoutes: "the platform's mail relay is blocked, not planned: a mail route is not valid (a domain must be a plain DNS name, a target must be <host>:25, one domain needs one target)";
 };
 /**
  * Plans the relay: nothing unless `mail.relay` is true. Planned when it was
@@ -84,24 +100,28 @@ export declare const MAIL_RELAY_BLOCKED: {
  */
 export declare function planMailRelay(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>, input: {
     routes: readonly MailRoute[];
-    platformDomains: readonly string[];
     executorBlocked: string | undefined;
-    mailReady: boolean;
 }): {
     step: DraftStep | null;
     blocked: string | null;
 };
 export interface MailRelayDeps {
-    coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'findOrCreateEnvironment' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deployAndWait' | 'raw'>;
+    coolify: Pick<CoolifyPort, 'findApplicationByName' | 'getApplication' | 'findOrCreateEnvironment' | 'createDockerfileApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'listStorages' | 'createPersistentStorage' | 'restart' | 'getDeployment' | 'deployAndWait' | 'raw'>;
     runtime?: DeployHealthRuntime;
 }
 /**
  * Makes the relay true: finds or creates the app, sets its internal name and
- * host port 25, writes env, and deploys when it was just created, its env or
- * base changed, or it is not running (decided from the live app). The old
- * container is stopped first, because two containers cannot both bind port 25.
- * The routes fingerprint is recorded last, so a run that fails halfway leaves
- * the step planned and the next apply repairs it. No secret exists here.
+ * host port 25, mounts the queue volume once, writes env, and then does the
+ * least that makes it true (decided from the live app):
+ * - a rebuild (stop, deploy) when the app was just created, the Dockerfile or
+ *   volume changed, or the volume was just added. The old container is stopped
+ *   first, because two containers cannot both bind port 25;
+ * - a deploy when the container is not running;
+ * - a restart of the same container when only the routes, domains or hostname
+ *   changed. Postfix reads its routes at start, nothing else is needed.
+ * The two fingerprints are recorded last, so a run that fails halfway (env
+ * written, restart failed) leaves the step planned and the next apply
+ * finishes it. No secret exists here.
  */
 export declare function provisionMailRelay(action: {
     desired: Record<string, unknown>;
@@ -113,7 +133,6 @@ export declare function provisionMailRelay(action: {
     projectUuid: string;
     serverUuid: string;
     hostname: string;
-    defaultTarget: string;
     appScopeKey: string;
 }): Promise<{
     resourceId: string;

package/dist/plan/mail-relay.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { VERSIONS } from '../bootstrap/versions.js';
+import { pinnedRef } from '../bootstrap/versions.js';
 import { waitForDeploymentFinished } from './deploy-health.js';
 import { commandHealthCheckSettings, tcpProbe } from './health-check-settings.js';
 /**
@@ -13,12 +13,36 @@ import { commandHealthCheckSettings, tcpProbe } from './health-check-settings.js
  * Everything it knows reaches the container as env the step writes.
  */
 export const PLATFORM_MAIL_RELAY_KEY = 'platform:mail-relay';
-/** Fingerprint of the sorted routes and platform domains the last successful apply put live. */
+/** Fingerprint of the sorted routes the last successful apply put live. */
 export const PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY = 'mail_relay_routes_applied';
-/** The base image tag the last successful apply built the relay from. */
-export const PLATFORM_MAIL_RELAY_BASE_SCOPE_KEY = 'mail_relay_base_applied';
-/** The org-applied-state key the company mail step records its server's SMTP address under (`<internal name>:25`). */
+/**
+ * Fingerprint of what forces an image rebuild (the Dockerfile text, which holds
+ * the base image pin) and the spool volume the last successful apply put live.
+ * A routes change leaves it alone, so it restarts the container and rebuilds nothing.
+ */
+export const PLATFORM_MAIL_RELAY_BUILD_SCOPE_KEY = 'mail_relay_build_applied';
+/** Postfix's queue. On a volume, so mail not yet handed on survives a restart and a rebuild. */
+export const MAIL_RELAY_SPOOL_DIR = '/var/spool/postfix';
+export const MAIL_RELAY_SPOOL_VOLUME = 'platform-mail-relay-spool';
+/**
+ * The org-applied-state key the company mail step records its server's SMTP address under: `<server address>:<port>`,
+ * the port the company's Stalwart publishes on the server for the relay ({@link OWN_MAIL_SMTP_PORT_SCOPE_KEY}).
+ * The relay is on the platform's network and a company's mail server on the company's own, so the relay
+ * reaches it through the server, not by its container name.
+ */
 export const OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY = 'mail_smtp_internal';
+/** The host port a company's Stalwart publishes (mapped to its port 25) for the relay. */
+export const OWN_MAIL_SMTP_PORT_SCOPE_KEY = 'mail_smtp_port';
+/** The host ports companies' mail servers take, one each: the lowest free one in this range. */
+export const OWN_MAIL_SMTP_PORT_BASE = 25000;
+export const OWN_MAIL_SMTP_PORT_MAX = 25999;
+/** Whether `port` is one of the ports a company's mail server may publish. */
+export function isOwnMailSmtpPort(port) {
+    return (typeof port === 'number' &&
+        Number.isInteger(port) &&
+        port >= OWN_MAIL_SMTP_PORT_BASE &&
+        port <= OWN_MAIL_SMTP_PORT_MAX);
+}
 /** `executor.ts`'s `isRunningOrStarting`, restated: importing it would make this module and the planner import each other. */
 function isRunningOrStarting(status) {
     if (!status)
@@ -34,12 +58,16 @@ export function normalizeMailDomain(domain) {
     const lower = domain.toLowerCase();
     return lower.length <= 253 && DOMAIN_PATTERN.test(lower) ? lower : null;
 }
-/** Lower-cases and checks `<host>:25`; `null` for whitespace, metacharacters, another port or no host. */
+/** Lower-cases and checks `<host>:<port>`; `null` for whitespace, metacharacters, a port outside 1..65535 or no host. */
 export function normalizeMailTarget(target) {
     const lower = target.toLowerCase();
-    if (!lower.endsWith(':25'))
+    const colon = lower.lastIndexOf(':');
+    if (colon < 1)
+        return null;
+    const host = lower.slice(0, colon);
+    const port = lower.slice(colon + 1);
+    if (!/^[1-9][0-9]{0,4}$/.test(port) || Number(port) > 65535)
         return null;
-    const host = lower.slice(0, -3);
     return host.length <= 253 && HOST_PATTERN.test(host) ? lower : null;
 }
 /**
@@ -62,27 +90,15 @@ export function normalizeMailRoutes(routes) {
         .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
         .map(([domain, target]) => ({ domain, target }));
 }
-/** The platform's own mail domains, checked, de-duplicated, sorted; `null` when any is invalid. */
-export function normalizeMailDomains(domains) {
-    const out = new Set();
-    for (const domain of domains) {
-        const checked = normalizeMailDomain(domain);
-        if (!checked)
-            return null;
-        out.add(checked);
-    }
-    return [...out].sort();
-}
 /**
  * What the relay was last built to do, as one value. Order of the inputs does
- * not matter; a changed target, a new route or a new platform domain does.
+ * not matter; a changed target or a new route does.
  * Never empty, so a platform with no company route still records one.
  */
-export function mailRelayFingerprint(routes, platformDomains) {
+export function mailRelayFingerprint(routes) {
     const sortedRoutes = normalizeMailRoutes(routes) ?? [];
-    const sortedDomains = normalizeMailDomains(platformDomains) ?? [];
     return createHash('sha256')
-        .update(JSON.stringify([sortedRoutes.map((r) => [r.domain, r.target]), sortedDomains]))
+        .update(JSON.stringify(sortedRoutes.map((r) => [r.domain, r.target])))
         .digest('hex');
 }
 /**
@@ -92,10 +108,11 @@ export function mailRelayFingerprint(routes, platformDomains) {
  * the listed domains and nothing else (`reject_unauth_destination`), so it
  * cannot be used to send to a third party.
  *
- * Env: `MAIL_RELAY_HOSTNAME`, `MAIL_RELAY_DEFAULT_TARGET` (the platform
- * Stalwart, `<name>:25`), `MAIL_RELAY_ROUTES` (`domain=host:25`, comma
- * separated), `MAIL_RELAY_PLATFORM_DOMAINS` (comma separated, delivered to the
- * default target). `MAIL_RELAY_RENDER_ONLY=1` writes the files and stops, and
+ * Mail for a domain no company routes is refused: there is no platform mail
+ * server to fall back on, so no default target exists.
+ *
+ * Env: `MAIL_RELAY_HOSTNAME`, `MAIL_RELAY_ROUTES` (`domain=host:port`, comma
+ * separated). `MAIL_RELAY_RENDER_ONLY=1` writes the files and stops, and
  * `MAIL_RELAY_CONF_DIR` moves them; both are for tests.
  */
 export const MAIL_RELAY_ENTRYPOINT = `#!/bin/sh
@@ -111,10 +128,14 @@ ok_name() {
 }
 ok_domain() { ok_name "$1" && case "$1" in *.*) return 0 ;; esac; return 1; }
 ok_target() {
-  case "$1" in *:25) ;; *) return 1 ;; esac
-  ok_name "\${1%:25}"
+  h="\${1%:*}"
+  p="\${1##*:}"
+  [ "$h" != "$1" ] || return 1
+  case "$p" in ''|0*|*[!0-9]*) return 1 ;; esac
+  [ "\${#p}" -le 5 ] || return 1
+  [ "$p" -le 65535 ] || return 1
+  ok_name "$h"
 }
-ok_target "\${MAIL_RELAY_DEFAULT_TARGET:-}" || fail "MAIL_RELAY_DEFAULT_TARGET is not <host>:25"
 ok_name "\${MAIL_RELAY_HOSTNAME:-}" || fail "MAIL_RELAY_HOSTNAME is not a host name"
 : > "$conf/relay_domains"
 : > "$conf/transport"
@@ -123,14 +144,9 @@ for entry in \${MAIL_RELAY_ROUTES:-}; do
   d="\${entry%%=*}"
   t="\${entry#*=}"
   ok_domain "$d" || fail "a route domain is not a plain domain"
-  ok_target "$t" || fail "a route target is not <host>:25"
-  printf '%s OK\\n' "$d" >> "$conf/relay_domains"
-  printf '%s smtp:[%s]:25\\n' "$d" "\${t%:25}" >> "$conf/transport"
-done
-for d in \${MAIL_RELAY_PLATFORM_DOMAINS:-}; do
-  ok_domain "$d" || fail "a platform domain is not a plain domain"
+  ok_target "$t" || fail "a route target is not <host>:<port>"
   printf '%s OK\\n' "$d" >> "$conf/relay_domains"
-  printf '%s smtp:[%s]:25\\n' "$d" "\${MAIL_RELAY_DEFAULT_TARGET%:25}" >> "$conf/transport"
+  printf '%s smtp:[%s]:%s\\n' "$d" "\${t%:*}" "\${t##*:}" >> "$conf/transport"
 done
 unset IFS
 cat > "$conf/main.cf" <<CONF
@@ -144,6 +160,7 @@ local_recipient_maps =
 alias_maps =
 alias_database =
 relay_domains = texthash:$conf/relay_domains
+parent_domain_matches_subdomains =
 transport_maps = texthash:$conf/transport
 relay_recipient_maps =
 smtpd_relay_restrictions = reject_unauth_destination
@@ -158,30 +175,32 @@ exec postfix start-fg
 export function mailRelayDockerfile() {
     const script = Buffer.from(MAIL_RELAY_ENTRYPOINT, 'utf8').toString('base64');
     return [
-        `FROM alpine:${VERSIONS.alpine}`,
+        `FROM alpine:${pinnedRef('alpine')}`,
         `RUN apk add --no-cache postfix && echo ${script} | base64 -d > /entrypoint.sh && chmod +x /entrypoint.sh`,
         'EXPOSE 25',
         'ENTRYPOINT ["/entrypoint.sh"]',
         '',
     ].join('\n');
 }
+/** What a rebuild depends on: the Dockerfile and the spool mount. Routes, domains and hostname are not in it. */
+export function mailRelayBuildFingerprint() {
+    return createHash('sha256')
+        .update(JSON.stringify([mailRelayDockerfile(), MAIL_RELAY_SPOOL_DIR]))
+        .digest('hex');
+}
 /** The env the step writes; the only input the container reads. */
 export function mailRelayEnv(input) {
     return [
         { key: 'MAIL_RELAY_HOSTNAME', value: input.hostname },
-        { key: 'MAIL_RELAY_DEFAULT_TARGET', value: input.defaultTarget },
         {
             key: 'MAIL_RELAY_ROUTES',
             value: input.routes.map((r) => `${r.domain}=${r.target}`).join(','),
         },
-        { key: 'MAIL_RELAY_PLATFORM_DOMAINS', value: input.platformDomains.join(',') },
     ].map((e) => ({ ...e, literal: true }));
 }
 export const MAIL_RELAY_BLOCKED = {
-    mailNotEnabled: "the platform's mail relay is blocked, not planned: the platform's mail server is not enabled",
-    mailNotReady: "the platform's mail relay is blocked, not planned: the platform's mail server is neither applied nor planned",
     executorMissing: "the platform's mail relay is blocked, not planned: the host built the platform executor without its mail dependencies",
-    invalidRoutes: "the platform's mail relay is blocked, not planned: a mail route or platform mail domain is not valid (a domain must be a plain DNS name, a target must be <host>:25, one domain needs one target)",
+    invalidRoutes: "the platform's mail relay is blocked, not planned: a mail route is not valid (a domain must be a plain DNS name, a target must be <host>:25, one domain needs one target)",
 };
 /**
  * Plans the relay: nothing unless `mail.relay` is true. Planned when it was
@@ -193,21 +212,16 @@ export const MAIL_RELAY_BLOCKED = {
 export function planMailRelay(platform, recordedIds, input) {
     if (platform.mail.relay !== true)
         return { step: null, blocked: null };
-    if (!platform.mail.enabled)
-        return { step: null, blocked: MAIL_RELAY_BLOCKED.mailNotEnabled };
     if (input.executorBlocked)
         return { step: null, blocked: input.executorBlocked };
-    if (!input.mailReady)
-        return { step: null, blocked: MAIL_RELAY_BLOCKED.mailNotReady };
     const routes = normalizeMailRoutes(input.routes);
-    const platformDomains = normalizeMailDomains(input.platformDomains);
-    if (!routes || !platformDomains)
+    if (!routes)
         return { step: null, blocked: MAIL_RELAY_BLOCKED.invalidRoutes };
-    const fingerprint = mailRelayFingerprint(routes, platformDomains);
+    const fingerprint = mailRelayFingerprint(routes);
     const applied = Boolean(recordedIds[`coolify:app:${PLATFORM_MAIL_RELAY_KEY}`]);
     if (applied &&
         recordedIds[PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY] === fingerprint &&
-        recordedIds[PLATFORM_MAIL_RELAY_BASE_SCOPE_KEY] === VERSIONS.alpine) {
+        recordedIds[PLATFORM_MAIL_RELAY_BUILD_SCOPE_KEY] === mailRelayBuildFingerprint()) {
         return { step: null, blocked: null };
     }
     return {
@@ -216,7 +230,7 @@ export function planMailRelay(platform, recordedIds, input) {
                 system: 'coolify',
                 kind: 'app',
                 key: PLATFORM_MAIL_RELAY_KEY,
-                desired: { routes, platformDomains, fingerprint },
+                desired: { routes, fingerprint },
             },
             step: {
                 description: applied
@@ -231,18 +245,22 @@ export function planMailRelay(platform, recordedIds, input) {
 }
 /**
  * Makes the relay true: finds or creates the app, sets its internal name and
- * host port 25, writes env, and deploys when it was just created, its env or
- * base changed, or it is not running (decided from the live app). The old
- * container is stopped first, because two containers cannot both bind port 25.
- * The routes fingerprint is recorded last, so a run that fails halfway leaves
- * the step planned and the next apply repairs it. No secret exists here.
+ * host port 25, mounts the queue volume once, writes env, and then does the
+ * least that makes it true (decided from the live app):
+ * - a rebuild (stop, deploy) when the app was just created, the Dockerfile or
+ *   volume changed, or the volume was just added. The old container is stopped
+ *   first, because two containers cannot both bind port 25;
+ * - a deploy when the container is not running;
+ * - a restart of the same container when only the routes, domains or hostname
+ *   changed. Postfix reads its routes at start, nothing else is needed.
+ * The two fingerprints are recorded last, so a run that fails halfway (env
+ * written, restart failed) leaves the step planned and the next apply
+ * finishes it. No secret exists here.
  */
 export async function provisionMailRelay(action, context, deps, input) {
     const routes = normalizeMailRoutes((action.desired.routes ?? []));
-    const platformDomains = normalizeMailDomains((action.desired.platformDomains ?? []));
-    const defaultTarget = normalizeMailTarget(input.defaultTarget);
-    if (!routes || !platformDomains || !defaultTarget) {
-        throw new Error('platform:mail-relay: a mail route, platform domain or default target is invalid');
+    if (!routes) {
+        throw new Error('platform:mail-relay: a mail route is invalid');
     }
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -275,7 +293,18 @@ export async function provisionMailRelay(action, context, deps, input) {
         })).uuid;
     }
     await record(input.appScopeKey, appId);
-    const baseChanged = !justCreated && recorded[PLATFORM_MAIL_RELAY_BASE_SCOPE_KEY] !== VERSIONS.alpine;
+    const buildFingerprint = mailRelayBuildFingerprint();
+    const routesFingerprint = mailRelayFingerprint(routes);
+    const spoolMounted = (await deps.coolify.listStorages(appId)).persistent_storages?.some((s) => s.mount_path === MAIL_RELAY_SPOOL_DIR);
+    if (!spoolMounted) {
+        await deps.coolify.createPersistentStorage(appId, {
+            name: MAIL_RELAY_SPOOL_VOLUME,
+            mount_path: MAIL_RELAY_SPOOL_DIR,
+        });
+    }
+    // A volume added to an app that already exists binds only at a new container, so it is a rebuild too.
+    const baseChanged = !justCreated &&
+        (recorded[PLATFORM_MAIL_RELAY_BUILD_SCOPE_KEY] !== buildFingerprint || !spoolMounted);
     await deps.coolify.updateApplication(appId, {
         custom_internal_name: MAIL_RELAY_APP_NAME,
         ports_exposes: '25',
@@ -288,22 +317,32 @@ export async function provisionMailRelay(action, context, deps, input) {
     });
     const envs = mailRelayEnv({
         hostname: input.hostname,
-        defaultTarget,
         routes,
-        platformDomains,
     });
     const live = new Map((await deps.coolify.listEnvs(appId)).filter((e) => !e.is_preview).map((e) => [e.key, e.value]));
     const envsChanged = envs.some((e) => live.get(e.key) !== e.value);
     await deps.coolify.bulkUpsertEnvs(appId, envs);
-    if (justCreated || !running || envsChanged || baseChanged) {
-        if (!justCreated && running) {
+    // The recorded routes fingerprint, not only the env diff: env written by a run whose restart failed
+    // reads as unchanged on the next apply, and the routes would never go live.
+    const routesChanged = envsChanged || recorded[PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY] !== routesFingerprint;
+    const rebuild = async (stopFirst) => {
+        if (stopFirst) {
             await deps.coolify.raw('POST', `/applications/${appId}/stop`);
             await waitForStopped(deps.coolify, appId, runtime, sleep);
         }
         await waitForDeploymentFinished(deps.coolify, appId, runtime, 'platform:mail-relay', 'the relay keeps its previous routes');
+    };
+    if (justCreated || !running || baseChanged) {
+        await rebuild(!justCreated && running);
     }
-    await record(PLATFORM_MAIL_RELAY_BASE_SCOPE_KEY, VERSIONS.alpine);
-    await record(PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, mailRelayFingerprint(routes, platformDomains));
+    else if (routesChanged) {
+        // A restart that names no deployment cannot be told from the old container still being healthy.
+        const followed = await restartAndWaitHealthy(deps.coolify, appId, runtime, sleep);
+        if (!followed)
+            await rebuild(true);
+    }
+    await record(PLATFORM_MAIL_RELAY_BUILD_SCOPE_KEY, buildFingerprint);
+    await record(PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, routesFingerprint);
     return { resourceId: appId };
 }
 async function waitForStopped(coolify, appId, runtime, sleep) {
@@ -321,3 +360,41 @@ async function waitForStopped(coolify, appId, runtime, sleep) {
         await sleep(interval);
     }
 }
+/**
+ * Restarts the same container (no stop, no image build) and returns once it is
+ * healthy again. Coolify queues a restart and answers before the container
+ * moves, so the old container's healthy status alone proves nothing: the
+ * answer must name a deployment and that record must finish first. Returns
+ * false, having waited for nothing, when the answer names none.
+ */
+async function restartAndWaitHealthy(coolify, appId, runtime, sleep) {
+    const now = runtime.now ?? Date.now;
+    const timeout = runtime.readyTimeoutMs ?? 300_000;
+    const interval = runtime.readyIntervalMs ?? 5_000;
+    const deadline = now() + timeout;
+    const late = (what) => new Error(`platform:mail-relay: the relay app ${appId} did not ${what} within ${Math.round(timeout / 1000)}s after its restart; the relay keeps its previous routes. Apply again`);
+    const answer = (await coolify.restart(appId));
+    const deploymentUuid = typeof answer?.deployment_uuid === 'string' ? answer.deployment_uuid : undefined;
+    // No deployment to follow: health would be the old container's, so the caller rebuilds instead.
+    if (!deploymentUuid)
+        return false;
+    for (;;) {
+        const { status } = await coolify.getDeployment(deploymentUuid);
+        if (status === 'finished')
+            break;
+        if (status === 'failed' || status.startsWith('cancelled')) {
+            throw new Error(`platform:mail-relay: the restart (${deploymentUuid}) of ${appId} did not finish (status: ${status}); the relay keeps its previous routes. Apply again`);
+        }
+        if (now() >= deadline)
+            throw late('finish restarting');
+        await sleep(interval);
+    }
+    for (;;) {
+        const { status } = await coolify.getApplication(appId);
+        if (status?.includes('healthy') && !status.includes('unhealthy'))
+            return true;
+        if (now() >= deadline)
+            throw late('become healthy');
+        await sleep(interval);
+    }
+}

package/dist/plan/network-move.d.ts

@@ -0,0 +1,20 @@
+import type { DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+/**
+ * Recorded when a company's Coolify resources are known to sit on its own network (`co-<slug>`): by the
+ * first run for a company that has none yet, and by the move step when it ends. The value is the network name.
+ */
+export declare const NETWORK_APPLIED_SCOPE_KEY = "network_applied";
+/** A company with a Coolify project but no network marker was built on the shared network. */
+export declare function networkMoveNeeded(recordedIds: Readonly<Record<string, string>>): boolean;
+/** Whether the company holds a resource foundry adopted: it did not create it and never deletes it. */
+export declare function hasAdoptedResources(recordedIds: Readonly<Record<string, string>>): boolean;
+/**
+ * The one step a company built on the shared network plans, instead of all its others. Coolify cannot
+ * move a resource between networks in production, so the move deletes the company's apps and databases and
+ * the next apply builds them again on `co-<slug>`. It destroys and migrates, so apply asks for the typed
+ * company name, and it needs a fresh dump of every database first (`requireFreshBackupsForMove`). A company
+ * that adopted resources plans no move: foundry does not delete what it did not create, so those stay on
+ * the shared network (`diff.ts` reports it).
+ */
+export declare function planNetworkMove(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): DraftStep | null;

package/dist/plan/network-move.js

@@ -0,0 +1,41 @@
+/**
+ * Recorded when a company's Coolify resources are known to sit on its own network (`co-<slug>`): by the
+ * first run for a company that has none yet, and by the move step when it ends. The value is the network name.
+ */
+export const NETWORK_APPLIED_SCOPE_KEY = 'network_applied';
+/** The company's Coolify project: where `ensureCoolifyProject` records it. */
+const COOLIFY_PROJECT_SCOPE_KEY = 'coolify_project';
+/** A company with a Coolify project but no network marker was built on the shared network. */
+export function networkMoveNeeded(recordedIds) {
+    return Boolean(recordedIds[COOLIFY_PROJECT_SCOPE_KEY]) && !recordedIds[NETWORK_APPLIED_SCOPE_KEY];
+}
+/** Whether the company holds a resource foundry adopted: it did not create it and never deletes it. */
+export function hasAdoptedResources(recordedIds) {
+    return Object.keys(recordedIds).some((key) => key.startsWith('adopted.'));
+}
+/**
+ * The one step a company built on the shared network plans, instead of all its others. Coolify cannot
+ * move a resource between networks in production, so the move deletes the company's apps and databases and
+ * the next apply builds them again on `co-<slug>`. It destroys and migrates, so apply asks for the typed
+ * company name, and it needs a fresh dump of every database first (`requireFreshBackupsForMove`). A company
+ * that adopted resources plans no move: foundry does not delete what it did not create, so those stay on
+ * the shared network (`diff.ts` reports it).
+ */
+export function planNetworkMove(org, recordedIds) {
+    if (!networkMoveNeeded(recordedIds) || hasAdoptedResources(recordedIds))
+        return null;
+    const network = `co-${org.slug}`;
+    return {
+        action: {
+            system: 'coolify',
+            kind: 'network',
+            key: org.id,
+            desired: { network },
+        },
+        step: {
+            description: `move ${org.slug} onto its own Docker network ${network}: delete its apps and databases in Coolify after a fresh backup, then apply again to build them there (data is restored by hand)`,
+            destroys: true,
+            migrates: true,
+        },
+    };
+}