Prepare platform SMTP notifier and scoped Authelia custody

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680

sso-mfa/k8s/authelia/README.md

@@ -146,3 +146,29 @@ and any sidecar files. Keep the previous ConfigMap and image reference too.
 Rollback requires stopping 4.39 and restoring all three: database, ConfigMap,
 and image. The migrated database and 4.39 claims policy cannot be used by
 4.38. See `NK-WP-0041` for the exercised rollout and backup receipt.
+
+## Platform reset mail — NK-WP-0047 (prepared, not active)
+
+The csoc-platform-mail review branch replaces the filesystem notifier with native
+SMTP from platform@coulomb.social through IONOS submission/STARTTLS. Its password
+is a mounted file, never ConfigMap/env plaintext. smtp-custody.yaml projects only
+SMTP_PASSWORD from the existing platform-owned mailbox entry into sso/authelia-smtp.
+A dedicated sso/authelia-smtp-eso identity must first be admitted by railiance-platform
+(RPF-WP-0052, CCR-2026-0035). Do not reuse telemetry's role or copy its Secret.
+
+Order: founder approves exact custody/rollout; attended owner admission; apply
+service account/SecretStore/ExternalSecret with dry-run/diff; wait Ready;
+apply smtp-networkpolicy.yaml (Authelia only, public IPv4 TCP587; existing DNS/LDAP rules remain);
+compare live ConfigMap/deployment for unrelated drift; native Authelia validate;
+apply notifier/mount change and restart Authelia with headroom/recovery checks.
+Do not apply the changed ConfigMap/deployment while the runtime Secret is absent.
+Startup SMTP check stays enabled, TLS/certificate verification mandatory.
+SMTP startup check does not send mail. Request a NEW reset through the user's
+own browser, then verify actual inbox receipt and completed sign-in. Do not read
+old filesystem reset links or put fresh links into logs/evidence.
+
+Rollback notifier/mount to pre-change owner revision, preserving Authelia SQLite
+and all existing authentication Secret references. Record failed send privately
+using redacted outcome only. This does not reset a user's password by itself or
+add automated ReichelAg protocol email sending.
+Reference: https://www.authelia.com/configuration/notifications/smtp/

sso-mfa/k8s/authelia/configmap.yaml

@@ -87,10 +87,23 @@ data:
       local:
         path: /var/authelia/data/db.sqlite3
 
+    # NK-WP-0047: activate only after scoped ESO admission and SecretSynced.
     notifier:
-      disable_startup_check: true
+      disable_startup_check: false
-      filesystem:
+      smtp:
-        filename: /var/authelia/data/notification.txt
+        address: submission://smtp.ionos.de:587
+        timeout: 10s
+        username: platform@coulomb.social
+        sender: 'Coulomb Platform <platform@coulomb.social>'
+        identifier: auth.coulomb.social
+        subject: '[Coulomb Platform] {title}'
+        startup_check_address: platform@coulomb.social
+        disable_require_tls: false
+        disable_starttls: false
+        tls:
+          server_name: smtp.ionos.de
+          skip_verify: false
+          minimum_version: TLS1.2
 
     # ── Access control ────────────────────────────────────────────────────────
     # one_factor = password only. MFA is handled by KeyCape + privacyIDEA.

sso-mfa/k8s/authelia/deployment.yaml

@@ -56,6 +56,8 @@ spec:
 
           # ── Secret file paths — Authelia reads *_FILE env vars ──────────
           env:
+            - name: AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
+              value: /run/secrets/authelia-smtp/password
             - name: AUTHELIA_JWT_SECRET_FILE
               value: /run/secrets/authelia/jwt_secret
             - name: AUTHELIA_SESSION_SECRET_FILE
@@ -74,6 +76,9 @@ spec:
               value: template
 
           volumeMounts:
+            - name: smtp
+              mountPath: /run/secrets/authelia-smtp
+              readOnly: true
             # Config from ConfigMap
             - name: config
               mountPath: /config/configuration.yml
@@ -118,6 +123,10 @@ spec:
               memory: "256Mi"
 
       volumes:
+        - name: smtp
+          secret:
+            secretName: authelia-smtp
+            defaultMode: 0440
         - name: config
           configMap:
             name: authelia-config

sso-mfa/k8s/authelia/smtp-custody.yaml

@@ -0,0 +1,48 @@
+# Prepared NK-WP-0047; requires owner-admitted OpenBao role before activation.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: authelia-smtp-eso
+  namespace: sso
+automountServiceAccountToken: false
+---
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: openbao-authelia-smtp
+  namespace: sso
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: authelia-smtp-eso
+          serviceAccountRef:
+            name: authelia-smtp-eso
+            audiences:
+            - openbao
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: authelia-smtp
+  namespace: sso
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: SecretStore
+    name: openbao-authelia-smtp
+  target:
+    name: authelia-smtp
+    creationPolicy: Owner
+    template:
+      type: Opaque
+  data:
+  - secretKey: password
+    remoteRef:
+      key: workloads/railiance-telemetry/smtp
+      property: SMTP_PASSWORD

sso-mfa/k8s/authelia/smtp-networkpolicy.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-authelia-smtp-egress
+  namespace: sso
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: authelia
+  policyTypes:
+  - Egress
+  egress:
+  - to:
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
+        - 127.0.0.0/8
+        - 169.254.0.0/16
+        - 224.0.0.0/4
+        - 240.0.0.0/4
+    ports:
+    - protocol: TCP
+      port: 587

workplans/NK-WP-0047-platform-password-reset-mail.md

@@ -0,0 +1,59 @@
+---
+id: NK-WP-0047
+type: workplan
+title: "Deliver password-reset mail from platform mailbox"
+domain: infotech
+repo: net-kingdom
+status: active
+owner: codex
+topic_slug: net-kingdom
+created: "2026-10-06"
+updated: "2026-10-06"
+---
+
+# Scope
+
+CSOC-WP-0010 unblocks CSOC-WP-0008-T11. SMTP-only authentication notifications;
+no application template API or protocol-mail sending. Configuration is prepared,
+not live. Existing platform mailbox credential is reused through a new admitted
+consumer; telemetry roles/Secrets are not shared or copied.
+
+Knowledge: emergent-security0.2.6 deployment, verified-files, orientation-only;
+digest8d1d6a9d4d07fec7b619618de7dfe2254c1790f85f4198c7fe19db9751c02.
+Native validation and live SecretSynced/inbox proof remain pending.
+
+## Prepare native SMTP package and scoped runtime projection
+
+```task
+id: NK-WP-0047-T01
+status: done
+priority: high
+```
+
+Review branch changes only Authelia notifier to IONOS TLS platform sender, adds password-file mount and sso-only SecretStore/ExternalSecret/serviceaccount. Existing authentication secrets, identity config, images and replicas remain. SMTP startup check enabled; rollback procedure documented.
+
+## Admit custody and validate exact live rollout
+
+```task
+id: NK-WP-0047-T02
+status: wait
+priority: high
+```
+
+Depends on RPF-WP-0052/CCR-2026-0035 and founder exact go. Apply admission resources with server dry-run/diff, wait store/projection Ready without reading Secret values; native Authelia config validation, existing-config drift check, headroom/SQLite recovery preflight, reviewed rollout. Preserve issued identity/custody state; do not reconstruct old auth Secrets.
+
+## Complete actual reset and personal login acceptance
+
+```task
+id: NK-WP-0047-T03
+status: wait
+priority: high
+```
+
+User starts a fresh reset, receives email and completes password change privately then app login. Record accepted/received/authenticated separately, no links/tokens/passwords in evidence. Rollback notifier config/mount on runtime failure, leave mailbox/version/password unchanged.
+
+Prepared evidence: ten SMTP admission tests passed; notifier/password-mount
+and password-only ESO projection parsed; server dry-run accepted package
+resources. Dedicated SMTP egress is required and drafted. Native runtime
+credential validation, admitted consumer and inbox receipt remain pending.
+No live activation or mail sent.