From 8620c47655bd30dcf841865561d7d4888d81cd93 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 6 Oct 2026 19:30:58 +0200 Subject: [PATCH] Prepare platform SMTP notifier and scoped Authelia custody Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680 --- sso-mfa/k8s/authelia/README.md | 26 ++++++++ sso-mfa/k8s/authelia/configmap.yaml | 19 +++++- sso-mfa/k8s/authelia/deployment.yaml | 9 +++ sso-mfa/k8s/authelia/smtp-custody.yaml | 48 +++++++++++++++ sso-mfa/k8s/authelia/smtp-networkpolicy.yaml | 26 ++++++++ ...NK-WP-0047-platform-password-reset-mail.md | 59 +++++++++++++++++++ 6 files changed, 184 insertions(+), 3 deletions(-) create mode 100644 sso-mfa/k8s/authelia/smtp-custody.yaml create mode 100644 sso-mfa/k8s/authelia/smtp-networkpolicy.yaml create mode 100644 workplans/NK-WP-0047-platform-password-reset-mail.md diff --git a/sso-mfa/k8s/authelia/README.md b/sso-mfa/k8s/authelia/README.md index 51a56c8..bb5f012 100644 --- a/sso-mfa/k8s/authelia/README.md +++ b/sso-mfa/k8s/authelia/README.md @@ -146,3 +146,29 @@ and any sidecar files. Keep the previous ConfigMap and image reference too. Rollback requires stopping 4.39 and restoring all three: database, ConfigMap, and image. The migrated database and 4.39 claims policy cannot be used by 4.38. See `NK-WP-0041` for the exercised rollout and backup receipt. + +## Platform reset mail — NK-WP-0047 (prepared, not active) + +The csoc-platform-mail review branch replaces the filesystem notifier with native +SMTP from platform@coulomb.social through IONOS submission/STARTTLS. Its password +is a mounted file, never ConfigMap/env plaintext. smtp-custody.yaml projects only +SMTP_PASSWORD from the existing platform-owned mailbox entry into sso/authelia-smtp. +A dedicated sso/authelia-smtp-eso identity must first be admitted by railiance-platform +(RPF-WP-0052, CCR-2026-0035). Do not reuse telemetry's role or copy its Secret. + +Order: founder approves exact custody/rollout; attended owner admission; apply +service account/SecretStore/ExternalSecret with dry-run/diff; wait Ready; +apply smtp-networkpolicy.yaml (Authelia only, public IPv4 TCP587; existing DNS/LDAP rules remain); +compare live ConfigMap/deployment for unrelated drift; native Authelia validate; +apply notifier/mount change and restart Authelia with headroom/recovery checks. +Do not apply the changed ConfigMap/deployment while the runtime Secret is absent. +Startup SMTP check stays enabled, TLS/certificate verification mandatory. +SMTP startup check does not send mail. Request a NEW reset through the user's +own browser, then verify actual inbox receipt and completed sign-in. Do not read +old filesystem reset links or put fresh links into logs/evidence. + +Rollback notifier/mount to pre-change owner revision, preserving Authelia SQLite +and all existing authentication Secret references. Record failed send privately +using redacted outcome only. This does not reset a user's password by itself or +add automated ReichelAg protocol email sending. +Reference: https://www.authelia.com/configuration/notifications/smtp/ diff --git a/sso-mfa/k8s/authelia/configmap.yaml b/sso-mfa/k8s/authelia/configmap.yaml index 43305d9..3699ea3 100644 --- a/sso-mfa/k8s/authelia/configmap.yaml +++ b/sso-mfa/k8s/authelia/configmap.yaml @@ -87,10 +87,23 @@ data: local: path: /var/authelia/data/db.sqlite3 + # NK-WP-0047: activate only after scoped ESO admission and SecretSynced. notifier: - disable_startup_check: true - filesystem: - filename: /var/authelia/data/notification.txt + disable_startup_check: false + smtp: + address: submission://smtp.ionos.de:587 + timeout: 10s + username: platform@coulomb.social + sender: 'Coulomb Platform ' + identifier: auth.coulomb.social + subject: '[Coulomb Platform] {title}' + startup_check_address: platform@coulomb.social + disable_require_tls: false + disable_starttls: false + tls: + server_name: smtp.ionos.de + skip_verify: false + minimum_version: TLS1.2 # ── Access control ──────────────────────────────────────────────────────── # one_factor = password only. MFA is handled by KeyCape + privacyIDEA. diff --git a/sso-mfa/k8s/authelia/deployment.yaml b/sso-mfa/k8s/authelia/deployment.yaml index 75f0c6c..2847789 100644 --- a/sso-mfa/k8s/authelia/deployment.yaml +++ b/sso-mfa/k8s/authelia/deployment.yaml @@ -56,6 +56,8 @@ spec: # ── Secret file paths — Authelia reads *_FILE env vars ────────── env: + - name: AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE + value: /run/secrets/authelia-smtp/password - name: AUTHELIA_JWT_SECRET_FILE value: /run/secrets/authelia/jwt_secret - name: AUTHELIA_SESSION_SECRET_FILE @@ -74,6 +76,9 @@ spec: value: template volumeMounts: + - name: smtp + mountPath: /run/secrets/authelia-smtp + readOnly: true # Config from ConfigMap - name: config mountPath: /config/configuration.yml @@ -118,6 +123,10 @@ spec: memory: "256Mi" volumes: + - name: smtp + secret: + secretName: authelia-smtp + defaultMode: 0440 - name: config configMap: name: authelia-config diff --git a/sso-mfa/k8s/authelia/smtp-custody.yaml b/sso-mfa/k8s/authelia/smtp-custody.yaml new file mode 100644 index 0000000..7755fc5 --- /dev/null +++ b/sso-mfa/k8s/authelia/smtp-custody.yaml @@ -0,0 +1,48 @@ +# Prepared NK-WP-0047; requires owner-admitted OpenBao role before activation. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: authelia-smtp-eso + namespace: sso +automountServiceAccountToken: false +--- +apiVersion: external-secrets.io/v1 +kind: SecretStore +metadata: + name: openbao-authelia-smtp + namespace: sso +spec: + provider: + vault: + server: http://openbao.openbao.svc:8200 + path: platform + version: v2 + auth: + kubernetes: + mountPath: kubernetes + role: authelia-smtp-eso + serviceAccountRef: + name: authelia-smtp-eso + audiences: + - openbao +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: authelia-smtp + namespace: sso +spec: + refreshInterval: 1h + secretStoreRef: + kind: SecretStore + name: openbao-authelia-smtp + target: + name: authelia-smtp + creationPolicy: Owner + template: + type: Opaque + data: + - secretKey: password + remoteRef: + key: workloads/railiance-telemetry/smtp + property: SMTP_PASSWORD diff --git a/sso-mfa/k8s/authelia/smtp-networkpolicy.yaml b/sso-mfa/k8s/authelia/smtp-networkpolicy.yaml new file mode 100644 index 0000000..9710cda --- /dev/null +++ b/sso-mfa/k8s/authelia/smtp-networkpolicy.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-authelia-smtp-egress + namespace: sso +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: authelia + policyTypes: + - Egress + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + - 127.0.0.0/8 + - 169.254.0.0/16 + - 224.0.0.0/4 + - 240.0.0.0/4 + ports: + - protocol: TCP + port: 587 diff --git a/workplans/NK-WP-0047-platform-password-reset-mail.md b/workplans/NK-WP-0047-platform-password-reset-mail.md new file mode 100644 index 0000000..3d605ac --- /dev/null +++ b/workplans/NK-WP-0047-platform-password-reset-mail.md @@ -0,0 +1,59 @@ +--- +id: NK-WP-0047 +type: workplan +title: "Deliver password-reset mail from platform mailbox" +domain: infotech +repo: net-kingdom +status: active +owner: codex +topic_slug: net-kingdom +created: "2026-10-06" +updated: "2026-10-06" +--- + +# Scope + +CSOC-WP-0010 unblocks CSOC-WP-0008-T11. SMTP-only authentication notifications; +no application template API or protocol-mail sending. Configuration is prepared, +not live. Existing platform mailbox credential is reused through a new admitted +consumer; telemetry roles/Secrets are not shared or copied. + +Knowledge: emergent-security0.2.6 deployment, verified-files, orientation-only; +digest8d1d6a9d4d07fec7b619618de7dfe2254c1790f85f4198c7fe19db9751c02. +Native validation and live SecretSynced/inbox proof remain pending. + +## Prepare native SMTP package and scoped runtime projection + +```task +id: NK-WP-0047-T01 +status: done +priority: high +``` + +Review branch changes only Authelia notifier to IONOS TLS platform sender, adds password-file mount and sso-only SecretStore/ExternalSecret/serviceaccount. Existing authentication secrets, identity config, images and replicas remain. SMTP startup check enabled; rollback procedure documented. + +## Admit custody and validate exact live rollout + +```task +id: NK-WP-0047-T02 +status: wait +priority: high +``` + +Depends on RPF-WP-0052/CCR-2026-0035 and founder exact go. Apply admission resources with server dry-run/diff, wait store/projection Ready without reading Secret values; native Authelia config validation, existing-config drift check, headroom/SQLite recovery preflight, reviewed rollout. Preserve issued identity/custody state; do not reconstruct old auth Secrets. + +## Complete actual reset and personal login acceptance + +```task +id: NK-WP-0047-T03 +status: wait +priority: high +``` + +User starts a fresh reset, receives email and completes password change privately then app login. Record accepted/received/authenticated separately, no links/tokens/passwords in evidence. Rollback notifier config/mount on runtime failure, leave mailbox/version/password unchanged. + +Prepared evidence: ten SMTP admission tests passed; notifier/password-mount +and password-only ESO projection parsed; server dry-run accepted package +resources. Dedicated SMTP egress is required and drafted. Native runtime +credential validation, admitted consumer and inbox receipt remain pending. +No live activation or mail sent.