fix(mail): site mail was undeliverable — plus make direct-MX actually deliverable

[nechodom]

No e-mail sent by any hosted PHP site has left any node since 45d963a — password resets, WooCommerce order confirmations, contact forms. It is in every release from v0.1.0 to v0.13.0.

What broke

That commit pointed sendmail_path at the logging wrapper:

php_admin_value[sendmail_path] = .../site-mail-wrapper -u {{ system_user }}

PHP's compiled default is /usr/sbin/sendmail -t -i, and setting the INI replaces that string whole — the flags are not merged. Nothing added them back: PHP appends only mail()'s 5th argument, and the wrapper forwards argv verbatim.

So the real sendmail was exec'd with the message on stdin and no recipient anywhere, because without -t the To: header is inert. Reproduced against Postfix's own sendmail:

$ printf 'To: b@example.com\n\nbody\n' | /usr/sbin/sendmail
sendmail: fatal: Recipient addresses must be specified on the command line or via the -t option

exit 75. Nothing is enqueued, so there is no bounce and no queue trail — only a fatal line in syslog that nobody correlates with "the customer says the reset link never arrived".

Why it survived six releases

Two things actively hid it:

• The wrapper writes its JSONL record before forwarding, so the panel's per-hosting Emails log shows a healthy stream of messages that were never queued. The operator's own evidence says mail works.
• Settings → Mail "send test" passes -t and skips the wrapper entirely, so the one tool used to check mail exercises a different path than production and cannot fail the way production fails.

The fix

The flags are restored in the wrapper, not only in the pool template. Pool files already on disk are not regenerated until a hosting is re-saved, while update.sh reinstalls the wrapper on every node — so this repairs existing sites on update without rewriting and reloading every FPM pool on the box. The template gets them too, so the requirement is visible where the value is set, and the wrapper skips its own pair when the caller already passed one.

Also fixed, found while verifying the above: exec discards the EXIT trap, so every outgoing message left a full copy in /tmp forever — 0600, owned by the site user, unbounded. The temp file is now unlinked before the exec and handed over on an open descriptor.

Verification

Against a stub sendmail, all three call shapes:

pool value on disk	reaches sendmail as
old (-u site1)	-t -i
new (-u site1 -t -i)	-t -i (not doubled)
PHPMailer (-u site1 -fwp@site.cz)	-t -i -fwp@site.cz

Body still arrives, JSONL line still written, /tmp empty across repeated sends.

Follow-up, not in this PR

The mail test should invoke the wrapper for a real hosting instead of calling /usr/sbin/sendmail directly, so the diagnostic exercises the production path. As it stands it is structurally incapable of catching this class of bug.

🤖 Generated with Claude Code