# Private M2Usenet onion ingress

The integrated M2Usenet sender connects through Tor directly to the Mail2News
onion service. The production hidden service uses Tor v3 client authorization
and terminates on a dedicated loopback-only Postfix listener.

Apply the fragments from this directory through the normal configuration
management or deployment process. They are intentionally not complete server
configuration files.

Deployment order:

1. Generate a Tor v3 client-authorization key pair outside the repository.
2. Install the public authorization entry in the hidden service's
   `authorized_clients` directory on the Mail2News host.
3. Install the private authorization entry in `ClientOnionAuthDir` on the
   M2Usenet host, mode `0600`, readable only by the Tor service account.
4. Install and compile the Postfix maps, then validate Postfix.
5. Validate Tor configuration and reload both services.
6. Test unauthorized connection rejection and recipient restrictions before
   deploying `send.php`.
7. Deploy the committed application revision and verify final NNTP
   publication with a controlled article.

Never commit either authorization entry. A Tor hidden-service connection
arrives from loopback, so it must never be forwarded to a Postfix listener
that grants relay permission to `mynetworks`.