# Private M2Usenet onion ingress

The integrated M2Usenet sender connects through Tor directly to the Mail2News
onion service. The production hidden service uses Tor v3 client authorization
and terminates on a dedicated loopback-only Postfix listener.

Apply the fragments from this directory through the normal configuration
management or deployment process. They are intentionally not complete server
configuration files.

The legacy `qee4...onion` listener on Victor accepts two narrowly scoped
email-client recipient forms:

```text
mail2news-YYYYMMDD-group.one=group.two@mail2news.tcpreset.net
mail2news-YYYYMMDD-group.one=group.two@xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion
```

`qee-mail2news-access` permits only that dated syntax, with either exact domain
and at most three validated-looking newsgroups. `qee-mail2news-aliases`
rewrites only the SMTP envelope recipient to the exact private Mail2News onion
address. The visible `To` header is preserved so Mail2News can perform
authoritative date and newsgroup validation. Append the alias fragment to
Victor's existing `virtual_alias_maps`; do not replace the other maps. This
keeps the Victor-to-Diego leg on the client-authorized onion route and does not
permit general SMTP relay.

Deployment order:

1. Generate a Tor v3 client-authorization key pair outside the repository.
2. Install the public authorization entry in the hidden service's
   `authorized_clients` directory on the Mail2News host.
3. Install the private authorization entry in `ClientOnionAuthDir` on the
   M2Usenet host, mode `0600`, readable only by the Tor service account.
4. Install and compile the Postfix maps, then validate Postfix.
5. Validate Tor configuration and reload both services.
6. Test the dated Mail2News recipient and reject malformed, unrelated,
   `_nospam`, four-group, and multi-recipient cases. Date freshness remains an
   authoritative Mail2News check after message acceptance.
7. Deploy the committed application revision and verify final NNTP
   publication with a controlled article.

Never commit either authorization entry. A Tor hidden-service connection
arrives from loopback, so it must never be forwarded to a Postfix listener
that grants relay permission to `mynetworks`.