50 lines
2.8 KiB
Markdown
50 lines
2.8 KiB
Markdown
|
# Approved SMTP activation — waiting for attended admission
|
||
|
|
|
||
|
|
2026-10-06 · CSOC-WP-0010 / NK-WP-0047 / RPF-WP-0052 / CCR-2026-0035.
|
||
|
|
Founder explicitly approved: “I approve let's wire this.” Decision
|
||
|
|
d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e is resolved by that human answer.
|
||
|
|
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
|
||
|
|
No additional permission request is outstanding. Owner-attended execution is.
|
||
|
|
|
||
|
|
## Executed
|
||
|
|
|
||
|
|
Fresh checks confirmed railiance01/92.205.62.239 and CPU requests3455m/4000m.
|
||
|
|
Ten SMTP admission tests still pass. Repeated server dry-run/diff accepted the
|
||
|
|
reviewed objects. Installed sso/authelia-smtp-eso ServiceAccount,
|
||
|
|
openbao-authelia-smtp SecretStore, authelia-smtp ExternalSecret and additive
|
||
|
|
Authelia-only public TCP587 network egress. Native Kubernetes auth remains a
|
||
|
|
scoped new consumer; no static token or copied telemetry Secret was used.
|
||
|
|
|
||
|
|
A manual clone of the existing authelia-backup CronJob completed successfully:
|
||
|
|
csoc-authelia-pre-smtp-20261006, started2026-10-06T18:20:38Z,
|
||
|
|
completed18:20:43Z, succeeded1. Used the owner backup procedure with all child
|
||
|
|
outputs suppressed; no backup/credential content entered evidence. This is
|
||
|
|
backup-job completion, not restore-drill acceptance.
|
||
|
|
|
||
|
|
Approved NetKingdom source was merged/pushed to main27c3edf so future package
|
||
|
|
reconciliation retains the declared SMTP wiring. The deployed notifier and pod
|
||
|
|
mounts are still the previous configuration. Authelia stays1/1 healthy, image
|
||
|
|
v4.39.28; no restart or password change performed. Temporary native validation
|
||
|
|
Job/config are prepared and server-dry-run accepted, not launched while the
|
||
|
|
runtime SMTP Secret is unavailable. It uses ephemeral data, preserving liveSQLite.
|
||
|
|
|
||
|
|
## Remaining dependency
|
||
|
|
|
||
|
|
The SecretStore/ExternalSecret are currently not Ready. Contained event analysis
|
||
|
|
identifies an invalid/missing OpenBao role; no credential values or raw errors
|
||
|
|
were emitted. The required attended owner command has not produced a receipt
|
||
|
|
at /tmp/authelia-smtp-delivery-first.json. The founder was asked to run it from
|
||
|
|
their own terminal under the estate orientation §5:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json
|
||
|
|
```
|
||
|
|
|
||
|
|
Resume: verify actual Warden child completion and fixed verified receipt;
|
||
|
|
force scoped ESO reconciliation and wait Ready; run native validator with the
|
||
|
|
mounted password; compare live config/deployment and retain only reviewed changes;
|
||
|
|
apply notifier/mount update from railiance01, restart/wait health and verify
|
||
|
|
SMTP startup status. Then user requests a NEW reset and confirms inbox receipt,
|
||
|
|
private password change and app login. Do not extract filesystem reset links.
|
||
|
|
No mail was sent by the agent, and SMTP remains inactive until these steps pass.
|