I managed to get the e-mail server working again. There were a huge number of changes related to new init scripts in the new version. I probably should have done a clean install instead of trying an upgrade.
Among the problems were
- An AppArmor profile in complain mode that nonetheless seems to have blocked writes to a Unix socket,
- Changes to the startup scripts that services use, so that OpenDKIM and SpamAssassin were both looking at default socket locations instead of the ones I had previously configured,
- Changes to when SpamAssassin looks at /etc/resolve.conf, so that DNS lookups were sent to localhost instead of the resolvers that were configured later in the startup process,
- Permissions changes done by the package upgrades, and
- A more sensitive parser for Fail2Ban configs that fails when it didn’t used to.
Anyway, mail service seems to be back. So, that’s nice.