Allow restricted email-client Mail2News addressing

4 files changed, 28 insertions, 4 deletions

diff --git a/deploy/README.md b/deploy/README.md
index 5046bb5..055de1e 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -8,6 +8,22 @@ Apply the fragments from this directory through the normal configuration
 management or deployment process. They are intentionally not complete server
 configuration files.
 
+The legacy `qee4...onion` listener on Victor accepts one narrowly scoped
+email-client recipient form:
+
+```text
+mail2news-YYYYMMDD-group.one=group.two@mail2news.tcpreset.net
+```
+
+`qee-mail2news-access` permits only that dated syntax, with at most three
+validated-looking newsgroups. `qee-mail2news-aliases` rewrites only the SMTP
+envelope recipient to the exact private Mail2News onion address. The visible
+`To` header is preserved so Mail2News can perform authoritative date and
+newsgroup validation. Append the alias fragment to Victor's existing
+`virtual_alias_maps`; do not replace the other maps. This keeps the
+Victor-to-Diego leg on the client-authorized onion route and does not permit
+general SMTP relay.
+
 Deployment order:
 
 1. Generate a Tor v3 client-authorization key pair outside the repository.
@@ -17,8 +33,9 @@ Deployment order:
    M2Usenet host, mode `0600`, readable only by the Tor service account.
 4. Install and compile the Postfix maps, then validate Postfix.
 5. Validate Tor configuration and reload both services.
-6. Test unauthorized connection rejection and recipient restrictions before
-   deploying `send.php`.
+6. Test the dated Mail2News recipient and reject malformed, unrelated,
+   `_nospam`, four-group, and multi-recipient cases. Date freshness remains an
+   authoritative Mail2News check after message acceptance.
 7. Deploy the committed application revision and verify final NNTP
    publication with a controlled article.
 
diff --git a/deploy/postfix/qee-mail2news-access b/deploy/postfix/qee-mail2news-access
new file mode 100644
index 0000000..f8c23a7
--- /dev/null
+++ b/deploy/postfix/qee-mail2news-access
@@ -0,0 +1,3 @@
+# Permit only the dated Mail2News recipient syntax used by ordinary email
+# clients. Everything else is rejected by the dedicated qee onion listener.
+/^mail2news-[0-9]{8}-[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+(=[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+){0,2}@mail2news\.tcpreset\.net$/ OK
diff --git a/deploy/postfix/qee-mail2news-aliases b/deploy/postfix/qee-mail2news-aliases
new file mode 100644
index 0000000..3025ccf
--- /dev/null
+++ b/deploy/postfix/qee-mail2news-aliases
@@ -0,0 +1,4 @@
+# Preserve the user-facing To header, but rewrite the SMTP envelope to the
+# exact client-authorized Mail2News onion ingress. Mail2News extracts and
+# validates the date and newsgroups from the original To header.
+/^mail2news-[0-9]{8}-[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+(=[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+){0,2}@mail2news\.tcpreset\.net$/ mail2news@xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion
diff --git a/deploy/postfix/victor-master.cf.fragment b/deploy/postfix/victor-master.cf.fragment
index 9012438..2e00cc1 100644
--- a/deploy/postfix/victor-master.cf.fragment
+++ b/deploy/postfix/victor-master.cf.fragment
@@ -5,8 +5,8 @@
   -o myhostname=qee4i7sags6phsvb2yodwecfj7noimfhhalsjktsvikrwotxzis3raad.onion
   -o smtpd_tls_security_level=none
   -o smtpd_sasl_auth_enable=no
-  -o smtpd_relay_restrictions=reject_unauth_destination
-  -o smtpd_recipient_restrictions=reject_unauth_destination
+  -o smtpd_relay_restrictions=check_recipient_access,regexp:/etc/postfix/qee-mail2news-access,reject
+  -o smtpd_recipient_restrictions=check_recipient_access,regexp:/etc/postfix/qee-mail2news-access,reject
   -o smtpd_reject_unlisted_recipient=yes
   -o smtpd_helo_required=yes
   -o smtpd_recipient_limit=1