tegwick
8c45e0c0ee
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
108 lines
6.5 KiB
Markdown
108 lines
6.5 KiB
Markdown
# Platform email facilities — 2026-10-06
|
|
|
|
CSOC-WP-0010 · NK-WP-0047 · RPF-WP-0052 · CCR-2026-0035.
|
|
SMTP activation completed; see platform-email-active-2026-10-06.md. Inbox/recovery acceptance pending. No credentials fetched into agent
|
|
context, reset links read, private inbox scanned or mail sent in this session.
|
|
|
|
## What exists
|
|
|
|
The founder previously created platform@coulomb.social at IONOS. Platform owner
|
|
record docs/telemetry-smtp-custody.md reports September28 native STARTTLS/SMTP
|
|
AUTH success, admitted scoped consumer and provider-accepted package test mail.
|
|
Native receipt verified KV version2, password unmodified and coding-agent deny.
|
|
Live telemetry-alert-smtp ExternalSecret is currently Ready/SecretSynced. This
|
|
supports reusing existing mailbox custody, not copying the telemetry Secret or
|
|
claiming that a new consumer is authorized. A fresh recipient inbox check and
|
|
inbound mailbox operations are not established by that evidence.
|
|
|
|
email-connect is live 1/1, health200, runtime ExternalSecret SecretSynced. It is
|
|
an existing authenticated transactional invitation/verification sender on IONOS
|
|
SMTP587, currently forgejo@coulomb.social. Only user-engine can reach its API;
|
|
other applications must be admitted deliberately. Do not build a competing
|
|
mail-delivery application or copy SMTP passwords into every product.
|
|
|
|
Authelia currently writes recovery notifications into an internal filesystem.
|
|
The user's request therefore did not deliver recovery email. Its existing
|
|
NetworkPolicies allow DNS/LDAP egress but not SMTP. The app OIDC/client issue
|
|
is fixed; successful tegwick credential recovery/sign-in remains open.
|
|
|
|
## Prepared first release
|
|
|
|
NetKingdom review branch csoc-platform-mail:
|
|
- Native Authelia SMTP notifier: submission://smtp.ionos.de:587, fixed platform
|
|
username and Coulomb Platform <platform@coulomb.social> sender, TLS/STARTTLS
|
|
and certificate verification required, SMTP startup check enabled.
|
|
- Dedicated sso/authelia-smtp-eso ServiceAccount/SecretStore and ExternalSecret
|
|
projecting only SMTP_PASSWORD from the existing owner-held mailbox path to
|
|
sso/authelia-smtp:password; mounted read-only via password-file setting.
|
|
- Additive Authelia-only public IPv4 TCP587 egress; exclude private, loopback,
|
|
link-local and multicast/reserved ranges. Existing DNS/LDAP access remains.
|
|
- Authentication image, passwords, OIDC clients, tenant policy and SQLite data
|
|
stay in use. No changes to telemetry's role or Secret.
|
|
|
|
Platform custody review branch csoc-authelia-mail-custody:
|
|
- CCR-2026-0035 admits only the new sso/authelia-smtp-eso consumer to the exact
|
|
existing mailbox KV path. Kubernetes auth/OpenBao audience, max15m/no default
|
|
policy. A Vault path read necessarily covers the entry; ESO projects only
|
|
its SMTP_PASSWORD field. Do not claim field-level Vault ACL isolation.
|
|
- Silent authelia_smtp_delivery.py reuses the tested owner admission lane:
|
|
attended platform-admin required, verifies fixed settings and SMTP AUTH
|
|
without sending email, refuses differing existing policy/role, preserves
|
|
mailbox version/password, verifies coding-agent data/metadata deny.
|
|
- New receipt files mode0600/O_EXCL; fixed redacted results only.
|
|
|
|
Validation: ten owner SMTP admission tests passed, including dedicated-consumer
|
|
binding, changed-mailbox/settings rejection, conflicting-policy refusal and
|
|
unchanged telemetry binding. YAML notifier/mount/projection wiring checked.
|
|
Server dry-run accepted serviceaccount/store/projection/network/config/deployment.
|
|
Live Authelia ConfigMap data matches the pre-change owner source. Native validation
|
|
with the real scoped mounted credential and Ready/inbox checks remain rollout
|
|
steps; dry-run does not prove those dependencies.
|
|
|
|
## Activation handoff
|
|
|
|
Requires founder exact live go, ADMINISTER @ realm:kubernetes/railiance01,
|
|
activation=APPROVED. Earlier app deployment approval is not mailbox admission.
|
|
After source review, the founder runs an attended OpenBao admission from their
|
|
own terminal (estate orientation §5), without supplying a password to the agent:
|
|
|
|
```sh
|
|
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json
|
|
```
|
|
|
|
The helper must be run from the approved reviewed owner checkout. Use a fresh
|
|
receipt filename for each attempt. Warden child-completion and verified receipt
|
|
are required; an exit code or queued registration alone is not success.
|
|
After admission, apply custody objects and network policy from railiance01 with
|
|
fresh diff/dry-run; wait for store/projection Ready without reading Secret values.
|
|
Validate native Authelia config with the mounted credential and reviewed notifier.
|
|
Check headroom and SQLite backup before config/mount rollout; use existing
|
|
Recreate strategy and wait for health/SMTP startup success. No secret-bundle
|
|
rebuilds or static ESO-token scripts. On failure restore pre-change notifier/
|
|
mount, keep auth database/mailbox custody intact and report redacted failure.
|
|
|
|
The user then requests a NEW reset through auth.coulomb.social. They confirm
|
|
inbox receipt and set the password privately, then complete app login. Never
|
|
extract old filesystem links or treat provider acceptance as inbox receipt.
|
|
|
|
## Broader communication milestone
|
|
|
|
CSOC-WP-0010 covers a shared platform sender for approved invitations/notifications,
|
|
explicit API callers/templates, idempotency/retry/suppression/delivery evidence,
|
|
monitored reply/bounce ownership, DNS/provider checks and inbound access procedures.
|
|
Native authentication notifications use Authelia SMTP; application messages reuse
|
|
email-connect. Inbound IMAP access, who reads platform replies, and fresh domain
|
|
MX/SPF/DKIM/DMARC proof remain tasks, not assumed capabilities. ReichelAg protocol
|
|
email remains the user's existing manual clipboard/mail workflow.
|
|
|
|
References: owner telemetry custody/native receipt, EMAIL-WP-0004/package manifests,
|
|
and https://www.authelia.com/configuration/notifications/smtp/ (native syntax,
|
|
startup check sends no email, TLS and password-file support).
|
|
|
|
Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (founder approved; owner admission and rollout completed).
|
|
|
|
Custody helper/CCR/workplan preparation is committed on platform owner main
|
|
at5d889cfc1d5cd41dc5320600dece9bd29ab03a44; Repo Manager receipt
|
|
primary/railiance01 applied with expected=derived exact commit. This is source
|
|
registration, not mailbox-consumer admission. NetKingdom package is on the
|
|
csoc-platform-mail review branch until exact live go.
|