Was linking to the wrong path/filename

set the postfix helo string to the machine's hostname, overriding the Debian default 'localhost', since some MTAs require a hostname there

generate a self-signed certificate for PUBLIC_HOSTNAME and change DNS MX records to PRIMARY_HOSTNAME so it matches

set the DNS SOA RNAME domain contact email to hostmaster@PRIMARY_HOSTNAME and add an alias when creating the first mail user

Credit @shevski for early conversations around decentralizing email.

mwhahahaha

put all DKIM on the primary hostname since that's the only one guaranteed to be actually hosted (DNS) here; give new users a Spam folder too