blob: 5046bb56810787607944bb387c3dec7092e07998 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
# Private M2Usenet onion ingress
The integrated M2Usenet sender connects through Tor directly to the Mail2News
onion service. The production hidden service uses Tor v3 client authorization
and terminates on a dedicated loopback-only Postfix listener.
Apply the fragments from this directory through the normal configuration
management or deployment process. They are intentionally not complete server
configuration files.
Deployment order:
1. Generate a Tor v3 client-authorization key pair outside the repository.
2. Install the public authorization entry in the hidden service's
`authorized_clients` directory on the Mail2News host.
3. Install the private authorization entry in `ClientOnionAuthDir` on the
M2Usenet host, mode `0600`, readable only by the Tor service account.
4. Install and compile the Postfix maps, then validate Postfix.
5. Validate Tor configuration and reload both services.
6. Test unauthorized connection rejection and recipient restrictions before
deploying `send.php`.
7. Deploy the committed application revision and verify final NNTP
publication with a controlled article.
Never commit either authorization entry. A Tor hidden-service connection
arrives from loopback, so it must never be forwarded to a Postfix listener
that grants relay permission to `mynetworks`.
|
