diff options
Diffstat (limited to 'deploy/README.md')
| -rw-r--r-- | deploy/README.md | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/deploy/README.md b/deploy/README.md new file mode 100644 index 0000000..5046bb5 --- /dev/null +++ b/deploy/README.md @@ -0,0 +1,27 @@ +# Private M2Usenet onion ingress + +The integrated M2Usenet sender connects through Tor directly to the Mail2News +onion service. The production hidden service uses Tor v3 client authorization +and terminates on a dedicated loopback-only Postfix listener. + +Apply the fragments from this directory through the normal configuration +management or deployment process. They are intentionally not complete server +configuration files. + +Deployment order: + +1. Generate a Tor v3 client-authorization key pair outside the repository. +2. Install the public authorization entry in the hidden service's + `authorized_clients` directory on the Mail2News host. +3. Install the private authorization entry in `ClientOnionAuthDir` on the + M2Usenet host, mode `0600`, readable only by the Tor service account. +4. Install and compile the Postfix maps, then validate Postfix. +5. Validate Tor configuration and reload both services. +6. Test unauthorized connection rejection and recipient restrictions before + deploying `send.php`. +7. Deploy the committed application revision and verify final NNTP + publication with a controlled article. + +Never commit either authorization entry. A Tor hidden-service connection +arrives from loopback, so it must never be forwarded to a Postfix listener +that grants relay permission to `mynetworks`. |