Add isolated fixed-target Mailu gateway and owned preflight #10

Merged

PlasticDigits merged 4 commits from bb/portal-mail-gateway-thr_ywz2dcyd3p into main

2026-10-31 04:12:07 +00:00

PlasticDigits commented

2026-10-31 04:03:30 +00:00

Owner

Adds a separate credential-free Mailu TCP gateway under deploy/mail-gateway/**. The std-only relay forwards only to verified literal 167.233.253.175:587, preventing private-alias DNS recursion, with four sessions, fixed buffers and bounded connection/session time. It runs nonroot with no capabilities, writable root, ports, mounts, Docker socket, provider credentials or stream logs.

The proposed resource creates its own notification internal and outbound networks. Only an owned probe joins the notification network in this phase; current portal settings/hooks, API/PG and worker attachments stay unchanged. A later separately reviewed overlay may attach only worker while preserving its DB network and no default route.

Includes a narrowly scoped raw-mode Coolify provisioner, strict receipt reader, actual runtime boundary checks, current-worker direct-egress denial and owned unauthenticated STARTTLS/hostname/direct-other-target preflight. Gateway provisioning requires fresh independent source review. Actual observed NAT/source-IP evidence and separate owned delivery acceptance remain open; no SMTP AUTH or send is included or authorized by this increment.

Validation: two bounded Rust forwarding/resource tests; six synthetic provisioner identity/disabled-create/output-isolation/maximum-ID deployment tests; shell syntax; pinned Rust1.91 offline image build with no-volume Debian runtime and isolated OpenSSL/CA availability checks. Fixed backend independently matched current DNS and hostname-verified STARTTLS without AUTH/send. No-start image metadata probe confirmed UID10001, zero volumes/mounts and was removed; the same-daemon image binding is repeated at runtime. No runtime gateway resource has been provisioned yet.

Issue #3 remains open. No portal DB/contact key/runtime credentials are changed, and no new notification worker is introduced.

Adds a separate credential-free Mailu TCP gateway under `deploy/mail-gateway/**`. The std-only relay forwards only to verified literal `167.233.253.175:587`, preventing private-alias DNS recursion, with four sessions, fixed buffers and bounded connection/session time. It runs nonroot with no capabilities, writable root, ports, mounts, Docker socket, provider credentials or stream logs. The proposed resource creates its own notification internal and outbound networks. Only an owned probe joins the notification network in this phase; current portal settings/hooks, API/PG and worker attachments stay unchanged. A later separately reviewed overlay may attach only worker while preserving its DB network and no default route. Includes a narrowly scoped raw-mode Coolify provisioner, strict receipt reader, actual runtime boundary checks, current-worker direct-egress denial and owned unauthenticated STARTTLS/hostname/direct-other-target preflight. Gateway provisioning requires fresh independent source review. Actual observed NAT/source-IP evidence and separate owned delivery acceptance remain open; no SMTP AUTH or send is included or authorized by this increment. Validation: two bounded Rust forwarding/resource tests; six synthetic provisioner identity/disabled-create/output-isolation/maximum-ID deployment tests; shell syntax; pinned Rust1.91 offline image build with no-volume Debian runtime and isolated OpenSSL/CA availability checks. Fixed backend independently matched current DNS and hostname-verified STARTTLS without AUTH/send. No-start image metadata probe confirmed UID10001, zero volumes/mounts and was removed; the same-daemon image binding is repeated at runtime. No runtime gateway resource has been provisioned yet. Issue #3 remains open. No portal DB/contact key/runtime credentials are changed, and no new notification worker is introduced.

PlasticDigits added 2 commits

2026-10-31 04:03:30 +00:00

Add isolated fixed-target Mailu gateway and owned preflight b125519fef

Provision the public source pin before the first gateway build e0c03c2c89

PlasticDigits added 1 commit

2026-10-31 04:08:46 +00:00

Remove inherited volumes and bind gateway receipts to actual image 9d1dfca661

PlasticDigits added 1 commit

2026-10-31 04:10:00 +00:00

Exercise bounded gateway deployment commands at maximum resource ID c0e2ff235e

PlasticDigits merged commit 78a4482037 into main

2026-10-31 04:12:07 +00:00