From 294a05ead630776149db1e5cd637a40cf6875ee9 Mon Sep 17 00:00:00 2001
From: Gab <24553253+gabrix73@users.noreply.github.com>
Date: Sun, 16 Aug 2026 17:35:18 +0200
Subject: Secure private onion Mail2News ingress

---
 deploy/README.md | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 deploy/README.md

(limited to 'deploy/README.md')

diff --git a/deploy/README.md b/deploy/README.md
new file mode 100644
index 0000000..5046bb5
--- /dev/null
+++ b/deploy/README.md
@@ -0,0 +1,27 @@
+# Private M2Usenet onion ingress
+
+The integrated M2Usenet sender connects through Tor directly to the Mail2News
+onion service. The production hidden service uses Tor v3 client authorization
+and terminates on a dedicated loopback-only Postfix listener.
+
+Apply the fragments from this directory through the normal configuration
+management or deployment process. They are intentionally not complete server
+configuration files.
+
+Deployment order:
+
+1. Generate a Tor v3 client-authorization key pair outside the repository.
+2. Install the public authorization entry in the hidden service's
+   `authorized_clients` directory on the Mail2News host.
+3. Install the private authorization entry in `ClientOnionAuthDir` on the
+   M2Usenet host, mode `0600`, readable only by the Tor service account.
+4. Install and compile the Postfix maps, then validate Postfix.
+5. Validate Tor configuration and reload both services.
+6. Test unauthorized connection rejection and recipient restrictions before
+   deploying `send.php`.
+7. Deploy the committed application revision and verify final NNTP
+   publication with a controlled article.
+
+Never commit either authorization entry. A Tor hidden-service connection
+arrives from loopback, so it must never be forwarded to a Postfix listener
+that grants relay permission to `mynetworks`.
-- 
cgit v1.2.3