tegwick
89fd13ac2d
Adds tests/harness/docker-compose.yml running GreenMail 2.1.12 (digest-pinned) with SMTP 3025, IMAP 3143 and the API bound to 127.0.0.1 only, plus a config/harness-imap.yml scanner profile and harness README. Auth is disabled and no users are declared, so a mailbox is created on first login and per-test users need no provisioning. GreenMail standalone offers no STARTTLS, only plaintext or implicit TLS, while SMTPProvider hardcoded starttls() -- so no send could reach it. SMTPProvider now takes a security mode via EMAIL_CONNECT_SMTP_SECURITY, defaulting to starttls. plaintext is refused for any non-loopback host, and hostnames are never resolved to decide that, so a misconfigured deployment fails at startup rather than sending credentials in the clear. Trusting GreenMail's self-signed cert was rejected as the wider risk; see DECISIONS.md. Verified end to end against the live harness: SMTPProvider.send -> GreenMail -> ImapMailboxSource, and the documented scan-mailbox CLI. Suite: 52 passed with the harness down. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
38 lines
1.5 KiB
YAML
38 lines
1.5 KiB
YAML
# Local mail server for email-connect integration tests (EMAIL-WP-0005-T02).
|
|
#
|
|
# GreenMail serves SMTP and IMAP from one container and creates the declared
|
|
# accounts at startup, which is what the scanner's IMAP source and the
|
|
# transactional service's SMTP provider need.
|
|
#
|
|
# Everything here is test-only. The credentials below are deliberately
|
|
# non-secret and belong in the repo; real provider material is routed through
|
|
# OpenBao (see .claude/rules/credential-routing.md) and must never appear here.
|
|
services:
|
|
greenmail:
|
|
image: greenmail/standalone:2.1.12@sha256:9f32971b4f25d32b4de6fa2e297423768441c65e4541f6aecd7631c890a229a7
|
|
container_name: email-connect-harness
|
|
# Loopback-only bindings. The harness accepts unauthenticated-ish test
|
|
# traffic and must never be reachable from the network.
|
|
ports:
|
|
- "127.0.0.1:3025:3025" # SMTP
|
|
- "127.0.0.1:3143:3143" # IMAP
|
|
- "127.0.0.1:8080:8080" # GreenMail API (readiness, purge)
|
|
environment:
|
|
GREENMAIL_OPTS: >-
|
|
-Dgreenmail.setup.test.smtp
|
|
-Dgreenmail.setup.test.imap
|
|
-Dgreenmail.hostname=0.0.0.0
|
|
-Dgreenmail.auth.disabled
|
|
-Dgreenmail.verbose
|
|
# The image ships no curl/wget/nc, so readiness is probed with bash's
|
|
# /dev/tcp against both mail ports.
|
|
healthcheck:
|
|
test:
|
|
- CMD
|
|
- bash
|
|
- -c
|
|
- "exec 3<>/dev/tcp/127.0.0.1/3025 && exec 4<>/dev/tcp/127.0.0.1/3143"
|
|
interval: 2s
|
|
timeout: 3s
|
|
retries: 30
|
|
start_period: 5s
|