Secure private onion Mail2News ingress

1 files changed, 27 insertions, 0 deletions

diff --git a/deploy/README.md b/deploy/README.md
new file mode 100644
index 0000000..5046bb5
--- /dev/null
+++ b/deploy/README.md
@@ -0,0 +1,27 @@
+# Private M2Usenet onion ingress
+
+The integrated M2Usenet sender connects through Tor directly to the Mail2News
+onion service. The production hidden service uses Tor v3 client authorization
+and terminates on a dedicated loopback-only Postfix listener.
+
+Apply the fragments from this directory through the normal configuration
+management or deployment process. They are intentionally not complete server
+configuration files.
+
+Deployment order:
+
+1. Generate a Tor v3 client-authorization key pair outside the repository.
+2. Install the public authorization entry in the hidden service's
+   `authorized_clients` directory on the Mail2News host.
+3. Install the private authorization entry in `ClientOnionAuthDir` on the
+   M2Usenet host, mode `0600`, readable only by the Tor service account.
+4. Install and compile the Postfix maps, then validate Postfix.
+5. Validate Tor configuration and reload both services.
+6. Test unauthorized connection rejection and recipient restrictions before
+   deploying `send.php`.
+7. Deploy the committed application revision and verify final NNTP
+   publication with a controlled article.
+
+Never commit either authorization entry. A Tor hidden-service connection
+arrives from loopback, so it must never be forwarded to a Postfix listener
+that grants relay permission to `mynetworks`.