From 9679f3f3a177215717a6734a0b91161e00814504 Mon Sep 17 00:00:00 2001
From: Gab <24553253+gabrix73@users.noreply.github.com>
Date: Mon, 17 Aug 2026 14:25:18 +0200
Subject: Allow restricted email-client Mail2News addressing

---
 deploy/postfix/qee-mail2news-access      | 3 +++
 deploy/postfix/qee-mail2news-aliases     | 4 ++++
 deploy/postfix/victor-master.cf.fragment | 4 ++--
 3 files changed, 9 insertions(+), 2 deletions(-)
 create mode 100644 deploy/postfix/qee-mail2news-access
 create mode 100644 deploy/postfix/qee-mail2news-aliases

(limited to 'deploy/postfix')

diff --git a/deploy/postfix/qee-mail2news-access b/deploy/postfix/qee-mail2news-access
new file mode 100644
index 0000000..f8c23a7
--- /dev/null
+++ b/deploy/postfix/qee-mail2news-access
@@ -0,0 +1,3 @@
+# Permit only the dated Mail2News recipient syntax used by ordinary email
+# clients. Everything else is rejected by the dedicated qee onion listener.
+/^mail2news-[0-9]{8}-[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+(=[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+){0,2}@mail2news\.tcpreset\.net$/ OK
diff --git a/deploy/postfix/qee-mail2news-aliases b/deploy/postfix/qee-mail2news-aliases
new file mode 100644
index 0000000..3025ccf
--- /dev/null
+++ b/deploy/postfix/qee-mail2news-aliases
@@ -0,0 +1,4 @@
+# Preserve the user-facing To header, but rewrite the SMTP envelope to the
+# exact client-authorized Mail2News onion ingress. Mail2News extracts and
+# validates the date and newsgroups from the original To header.
+/^mail2news-[0-9]{8}-[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+(=[a-z][a-z0-9]+(\.[0-9a-z+_-]+)+){0,2}@mail2news\.tcpreset\.net$/ mail2news@xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion
diff --git a/deploy/postfix/victor-master.cf.fragment b/deploy/postfix/victor-master.cf.fragment
index 9012438..2e00cc1 100644
--- a/deploy/postfix/victor-master.cf.fragment
+++ b/deploy/postfix/victor-master.cf.fragment
@@ -5,8 +5,8 @@
   -o myhostname=qee4i7sags6phsvb2yodwecfj7noimfhhalsjktsvikrwotxzis3raad.onion
   -o smtpd_tls_security_level=none
   -o smtpd_sasl_auth_enable=no
-  -o smtpd_relay_restrictions=reject_unauth_destination
-  -o smtpd_recipient_restrictions=reject_unauth_destination
+  -o smtpd_relay_restrictions=check_recipient_access,regexp:/etc/postfix/qee-mail2news-access,reject
+  -o smtpd_recipient_restrictions=check_recipient_access,regexp:/etc/postfix/qee-mail2news-access,reject
   -o smtpd_reject_unlisted_recipient=yes
   -o smtpd_helo_required=yes
   -o smtpd_recipient_limit=1
-- 
cgit v1.2.3