Secure private onion Mail2News ingress

8 files changed, 69 insertions, 0 deletions

diff --git a/deploy/README.md b/deploy/README.md
new file mode 100644
index 0000000..5046bb5
--- /dev/null
+++ b/deploy/README.md
@@ -0,0 +1,27 @@
+# Private M2Usenet onion ingress
+
+The integrated M2Usenet sender connects through Tor directly to the Mail2News
+onion service. The production hidden service uses Tor v3 client authorization
+and terminates on a dedicated loopback-only Postfix listener.
+
+Apply the fragments from this directory through the normal configuration
+management or deployment process. They are intentionally not complete server
+configuration files.
+
+Deployment order:
+
+1. Generate a Tor v3 client-authorization key pair outside the repository.
+2. Install the public authorization entry in the hidden service's
+   `authorized_clients` directory on the Mail2News host.
+3. Install the private authorization entry in `ClientOnionAuthDir` on the
+   M2Usenet host, mode `0600`, readable only by the Tor service account.
+4. Install and compile the Postfix maps, then validate Postfix.
+5. Validate Tor configuration and reload both services.
+6. Test unauthorized connection rejection and recipient restrictions before
+   deploying `send.php`.
+7. Deploy the committed application revision and verify final NNTP
+   publication with a controlled article.
+
+Never commit either authorization entry. A Tor hidden-service connection
+arrives from loopback, so it must never be forwarded to a Postfix listener
+that grants relay permission to `mynetworks`.
diff --git a/deploy/postfix/diego-master.cf.fragment b/deploy/postfix/diego-master.cf.fragment
new file mode 100644
index 0000000..2a2e1d5
--- /dev/null
+++ b/deploy/postfix/diego-master.cf.fragment
@@ -0,0 +1,12 @@
+# Dedicated ingress for the private Mail2News onion hidden service.
+127.0.0.1:2526 inet n - n - 4 smtpd
+  -o syslog_name=postfix/m2usenet-onion
+  -o myhostname=xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion
+  -o smtpd_tls_security_level=none
+  -o smtpd_sasl_auth_enable=no
+  -o smtpd_relay_restrictions=reject_unauth_destination
+  -o smtpd_recipient_restrictions=check_recipient_access,hash:/etc/postfix/m2usenet-ingress,reject
+  -o smtpd_reject_unlisted_recipient=yes
+  -o smtpd_helo_required=yes
+  -o smtpd_recipient_limit=1
+  -o message_size_limit=131072
diff --git a/deploy/postfix/m2usenet-ingress b/deploy/postfix/m2usenet-ingress
new file mode 100644
index 0000000..fb42230
--- /dev/null
+++ b/deploy/postfix/m2usenet-ingress
@@ -0,0 +1 @@
+mail2news@xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion OK
diff --git a/deploy/postfix/victor-master.cf.fragment b/deploy/postfix/victor-master.cf.fragment
new file mode 100644
index 0000000..9012438
--- /dev/null
+++ b/deploy/postfix/victor-master.cf.fragment
@@ -0,0 +1,13 @@
+# Restricted target for the legacy qee4 hidden service. Do not forward it to
+# the ordinary SMTP listener, which may trust loopback through mynetworks.
+127.0.0.1:2527 inet n - n - 4 smtpd
+  -o syslog_name=postfix/qee-onion
+  -o myhostname=qee4i7sags6phsvb2yodwecfj7noimfhhalsjktsvikrwotxzis3raad.onion
+  -o smtpd_tls_security_level=none
+  -o smtpd_sasl_auth_enable=no
+  -o smtpd_relay_restrictions=reject_unauth_destination
+  -o smtpd_recipient_restrictions=reject_unauth_destination
+  -o smtpd_reject_unlisted_recipient=yes
+  -o smtpd_helo_required=yes
+  -o smtpd_recipient_limit=1
+  -o message_size_limit=131072
diff --git a/deploy/postfix/victor-transport.fragment b/deploy/postfix/victor-transport.fragment
new file mode 100644
index 0000000..cf7d820
--- /dev/null
+++ b/deploy/postfix/victor-transport.fragment
@@ -0,0 +1,3 @@
+# Exact lookup is required; relying only on a parent .onion key can select the
+# ordinary SMTP transport depending on Postfix parent-domain matching policy.
+xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion smtptor:
diff --git a/deploy/tor/.gitignore b/deploy/tor/.gitignore
new file mode 100644
index 0000000..e2124bd
--- /dev/null
+++ b/deploy/tor/.gitignore
@@ -0,0 +1,2 @@
+*.auth
+*.auth_private
diff --git a/deploy/tor/diego-torrc.fragment b/deploy/tor/diego-torrc.fragment
new file mode 100644
index 0000000..71847d6
--- /dev/null
+++ b/deploy/tor/diego-torrc.fragment
@@ -0,0 +1,4 @@
+# Client authorization entries are generated and installed outside Git under:
+# /var/lib/tor/mail/authorized_clients/
+HiddenServiceDir /var/lib/tor/mail/
+HiddenServicePort 25 127.0.0.1:2526
diff --git a/deploy/tor/victor-torrc.fragment b/deploy/tor/victor-torrc.fragment
new file mode 100644
index 0000000..b687f43
--- /dev/null
+++ b/deploy/tor/victor-torrc.fragment
@@ -0,0 +1,7 @@
+# The private client authorization entry is generated and installed outside
+# Git under this directory with mode 0600.
+ClientOnionAuthDir /var/lib/tor/onion_auth
+
+# Keep the legacy qee4 service isolated from the ordinary SMTP listener.
+HiddenServiceDir /var/lib/tor/Mail/
+HiddenServicePort 25 127.0.0.1:2527