diff options
Diffstat (limited to 'deploy')
| -rw-r--r-- | deploy/README.md | 27 | ||||
| -rw-r--r-- | deploy/postfix/diego-master.cf.fragment | 12 | ||||
| -rw-r--r-- | deploy/postfix/m2usenet-ingress | 1 | ||||
| -rw-r--r-- | deploy/postfix/victor-master.cf.fragment | 13 | ||||
| -rw-r--r-- | deploy/postfix/victor-transport.fragment | 3 | ||||
| -rw-r--r-- | deploy/tor/.gitignore | 2 | ||||
| -rw-r--r-- | deploy/tor/diego-torrc.fragment | 4 | ||||
| -rw-r--r-- | deploy/tor/victor-torrc.fragment | 7 |
8 files changed, 69 insertions, 0 deletions
diff --git a/deploy/README.md b/deploy/README.md new file mode 100644 index 0000000..5046bb5 --- /dev/null +++ b/deploy/README.md @@ -0,0 +1,27 @@ +# Private M2Usenet onion ingress + +The integrated M2Usenet sender connects through Tor directly to the Mail2News +onion service. The production hidden service uses Tor v3 client authorization +and terminates on a dedicated loopback-only Postfix listener. + +Apply the fragments from this directory through the normal configuration +management or deployment process. They are intentionally not complete server +configuration files. + +Deployment order: + +1. Generate a Tor v3 client-authorization key pair outside the repository. +2. Install the public authorization entry in the hidden service's + `authorized_clients` directory on the Mail2News host. +3. Install the private authorization entry in `ClientOnionAuthDir` on the + M2Usenet host, mode `0600`, readable only by the Tor service account. +4. Install and compile the Postfix maps, then validate Postfix. +5. Validate Tor configuration and reload both services. +6. Test unauthorized connection rejection and recipient restrictions before + deploying `send.php`. +7. Deploy the committed application revision and verify final NNTP + publication with a controlled article. + +Never commit either authorization entry. A Tor hidden-service connection +arrives from loopback, so it must never be forwarded to a Postfix listener +that grants relay permission to `mynetworks`. diff --git a/deploy/postfix/diego-master.cf.fragment b/deploy/postfix/diego-master.cf.fragment new file mode 100644 index 0000000..2a2e1d5 --- /dev/null +++ b/deploy/postfix/diego-master.cf.fragment @@ -0,0 +1,12 @@ +# Dedicated ingress for the private Mail2News onion hidden service. +127.0.0.1:2526 inet n - n - 4 smtpd + -o syslog_name=postfix/m2usenet-onion + -o myhostname=xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion + -o smtpd_tls_security_level=none + -o smtpd_sasl_auth_enable=no + -o smtpd_relay_restrictions=reject_unauth_destination + -o smtpd_recipient_restrictions=check_recipient_access,hash:/etc/postfix/m2usenet-ingress,reject + -o smtpd_reject_unlisted_recipient=yes + -o smtpd_helo_required=yes + -o smtpd_recipient_limit=1 + -o message_size_limit=131072 diff --git a/deploy/postfix/m2usenet-ingress b/deploy/postfix/m2usenet-ingress new file mode 100644 index 0000000..fb42230 --- /dev/null +++ b/deploy/postfix/m2usenet-ingress @@ -0,0 +1 @@ +mail2news@xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion OK diff --git a/deploy/postfix/victor-master.cf.fragment b/deploy/postfix/victor-master.cf.fragment new file mode 100644 index 0000000..9012438 --- /dev/null +++ b/deploy/postfix/victor-master.cf.fragment @@ -0,0 +1,13 @@ +# Restricted target for the legacy qee4 hidden service. Do not forward it to +# the ordinary SMTP listener, which may trust loopback through mynetworks. +127.0.0.1:2527 inet n - n - 4 smtpd + -o syslog_name=postfix/qee-onion + -o myhostname=qee4i7sags6phsvb2yodwecfj7noimfhhalsjktsvikrwotxzis3raad.onion + -o smtpd_tls_security_level=none + -o smtpd_sasl_auth_enable=no + -o smtpd_relay_restrictions=reject_unauth_destination + -o smtpd_recipient_restrictions=reject_unauth_destination + -o smtpd_reject_unlisted_recipient=yes + -o smtpd_helo_required=yes + -o smtpd_recipient_limit=1 + -o message_size_limit=131072 diff --git a/deploy/postfix/victor-transport.fragment b/deploy/postfix/victor-transport.fragment new file mode 100644 index 0000000..cf7d820 --- /dev/null +++ b/deploy/postfix/victor-transport.fragment @@ -0,0 +1,3 @@ +# Exact lookup is required; relying only on a parent .onion key can select the +# ordinary SMTP transport depending on Postfix parent-domain matching policy. +xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion smtptor: diff --git a/deploy/tor/.gitignore b/deploy/tor/.gitignore new file mode 100644 index 0000000..e2124bd --- /dev/null +++ b/deploy/tor/.gitignore @@ -0,0 +1,2 @@ +*.auth +*.auth_private diff --git a/deploy/tor/diego-torrc.fragment b/deploy/tor/diego-torrc.fragment new file mode 100644 index 0000000..71847d6 --- /dev/null +++ b/deploy/tor/diego-torrc.fragment @@ -0,0 +1,4 @@ +# Client authorization entries are generated and installed outside Git under: +# /var/lib/tor/mail/authorized_clients/ +HiddenServiceDir /var/lib/tor/mail/ +HiddenServicePort 25 127.0.0.1:2526 diff --git a/deploy/tor/victor-torrc.fragment b/deploy/tor/victor-torrc.fragment new file mode 100644 index 0000000..b687f43 --- /dev/null +++ b/deploy/tor/victor-torrc.fragment @@ -0,0 +1,7 @@ +# The private client authorization entry is generated and installed outside +# Git under this directory with mode 0600. +ClientOnionAuthDir /var/lib/tor/onion_auth + +# Keep the legacy qee4 service isolated from the ordinary SMTP listener. +HiddenServiceDir /var/lib/tor/Mail/ +HiddenServicePort 25 127.0.0.1:2527 |