Harden transport and preserve profile identitiesHEADmain

1 files changed, 56 insertions, 19 deletions

diff --git a/README.md b/README.md
index 35acc73..460c50f 100644
--- a/README.md
+++ b/README.md
@@ -15,10 +15,14 @@ Browser
   -> N2Usenet Go backend
   -> local nym-socks5-client
   -> Nym network requester
-  -> SMTP mail2news.tcpreset.net:25 STARTTLS
+  -> SMTP submission 51.178.55.22:587 STARTTLS + AUTH
+     (TLS name mail.virebent.art)
+  -> Postfix with SPF/DKIM/DMARC
   -> mail2news@mail2news.tcpreset.net
   -> Mail2News gateway
-  -> news.tcpreset.net NNTP
+  -> Tor SOCKS
+  -> peannyjkqwqfynd24p6dszvtchkq7hfkwymi5by5y332wmosy5dwfaqd.onion:119
+  -> news.tcpreset.net INN
 ```
 
 ## Build
@@ -37,18 +41,20 @@ go build -o n2u-check ./cmd/n2u-check
 - **Ed25519 signing**: the message is signed locally in the browser with the
   self-hosted TweetNaCl (`nacl`) library. The secret key never leaves the
   device; the server only verifies the signature against the submitted text.
-- **VFACE identicon / `Face:` header**: the public key deterministically
-  generates a visual identicon (`identicons-cli` engine, same backend as
+- **VFACE identicon / `Face:` header**: the complete
+  `username|email|public-key` identity deterministically generates a visual
+  identicon (`identicons-cli` engine, same backend as
   `identicons.virebent.art`), embedded as a folded `Face:` header alongside
   `X-Ed25519-Pub`/`X-Ed25519-Sig` so any reader can re-verify authorship.
 - **Optional persistent identity (save/load)**: after generating a keypair,
   "Save Identity" downloads a JSON file with the public/secret key and
-  username/email. Loading that file later reuses the same keypair, so the
-  same identicon keeps appearing across posts and proves later messages
-  come from the same author. This is entirely optional: skip it for a
-  fresh, unlinkable throwaway identity on every post. The file contains the
-  secret key in clear, so it must be kept private, anyone holding it can
-  sign as that identity.
+  username/email. Loading that file later restores the complete identity, so
+  the same identicon keeps appearing across posts and lets readers associate
+  later signatures with the same public key. Username, email, and keypair are
+  locked together while that identity is active. This is entirely optional:
+  skip it for a fresh, unlinkable throwaway identity on every post. The file
+  contains the secret key in clear, so it must be kept private, anyone holding
+  it can sign as that identity.
 - **Usenet-style line wrapping**: before signing, the message body is
   automatically word-wrapped to 72 columns (RFC 1855 Netiquette
   convention), for compatibility with classic terminal-based newsreaders.
@@ -58,9 +64,11 @@ go build -o n2u-check ./cmd/n2u-check
 - **CSRF protection and per-IP rate limiting**, both server-side.
 - **No access logs, ephemeral state**: identity and form data are kept only
   in browser tab memory and wiped after a successful send.
-- **Delivery over the Nym mixnet**, not Tor: SOCKS5 through a local
-  `nym-socks5-client`/`nym-network-requester` path to the Mail2News relay,
-  then into `news.tcpreset.net` via NNTP.
+- **Nym followed by Tor for separate hops**: SOCKS5 through a local
+  `nym-socks5-client`/`nym-network-requester` carries authenticated SMTP/TLS
+  submission to the Virebent MTA. Postfix signs and relays the message to
+  Mail2News. Mail2News then uses Tor to post to the TCPReset onion NNTP
+  endpoint. The browser-to-N2Usenet hop remains HTTPS.
 
 ## Required Configuration
 
@@ -70,14 +78,19 @@ Set these in an environment file or systemd unit:
 N2U_LISTEN=127.0.0.1:8095
 N2U_PUBLIC_BASE_URL=https://n2usenet.virebent.art
 
-N2U_SMTP_HOST=mail2news.tcpreset.net
-N2U_SMTP_PORT=25
-N2U_SMTP_TLS_SERVER_NAME=mail.tcpreset.net
+N2U_SMTP_HOST=51.178.55.22
+N2U_SMTP_PORT=587
+N2U_SMTP_TLS_SERVER_NAME=mail.virebent.art
 N2U_SMTP_IMPLICIT_TLS=false
 N2U_SMTP_RECIPIENT=mail2news@mail2news.tcpreset.net
 N2U_SMTP_ENVELOPE_FROM=n2usenet@virebent.art
+N2U_SMTP_SENDER=n2usenet@virebent.art
+N2U_SMTP_USERNAME=n2usenet@virebent.art
+N2U_SMTP_PASSWORD_FILE=/etc/n2usenet/smtp-password
 N2U_SMTP_HELO=n2usenet.virebent.art
+N2U_TRANSPORT_PROBE_INTERVAL=15m
 N2U_MESSAGE_ID_DOMAIN=n2usenet.virebent.art
+N2U_CSRF_KEY_FILE=/etc/n2usenet/csrf-key
 
 N2U_IDENTICONS_CLI=/usr/local/bin/identicons-cli
 N2U_REQUIRE_FACE=true
@@ -107,9 +120,32 @@ secrets. The provider address is deployment configuration.
 - SMTP uses a fixed envelope sender by default, `n2usenet@virebent.art`, so the
   Mail2News relay does not depend on the user's pseudonymous email passing
   remote sender policy checks.
+- The RFC 5322 `From:` header publishes the complete profile identity,
+  `username <email>`. `Sender:` identifies `n2usenet@virebent.art` as the
+  submitting agent, while SMTP AUTH and the envelope sender remain fixed on
+  that service account. The profile email is a signed pseudonymous identity
+  claim, not proof that the user controls its domain.
+- SMTP credentials are read from a root-managed file and AUTH is rejected by
+  the application configuration unless TLS is enabled.
+- Production uses the MTA's global IPv4 address as the SOCKS destination while
+  still verifying `mail.virebent.art` in TLS. This keeps the Nym requester's
+  non-global-address filter strict when the MTA host resolves its own hostname
+  to local interface addresses.
 - `/submit` returns `Cache-Control: no-store` and the browser path uses fetch
   so successful submissions do not leave the full form state in the rendered
   response page.
+- The CSRF cookie is session-scoped without a fixed elapsed-time expiry. The
+  browser refreshes the signed token immediately before submission. Production
+  uses a root-managed signing key so restarts do not invalidate open tabs, and
+  valid session tokens are reused so multiple tabs cannot rotate each other's
+  cookie.
+- `/healthz` reports only process liveness. `/readyz` reports the cached result
+  of a background Nym/STARTTLS/SMTP AUTH probe and never creates transport
+  traffic in response to an HTTP request.
+- `n2usenet-gateway-watch.timer` checks the active Nym gateway registration
+  daily. It rotates only within 24 hours of expiry, verifies the complete SMTP
+  path without sending mail, and restores the previous gateway database if the
+  replacement fails.
 - The app does not add a clearnet fallback to the M2Usenet onion PHP sender.
 - The service now prefers the `N2U_*` environment variable prefix and still
   accepts legacy `M2U_*` variables during the rollout.
@@ -125,10 +161,11 @@ Working deployment shape:
 - `victor` and `rasmus` are SSH aliases for the same host, `51.178.55.22`.
 - `victor` runs `n2usenet-network-requester.service`.
 - `pietro` runs `n2usenet-socks.service` on `127.0.0.1:11080`.
-- `pietro` runs `n2usenet.service` with SMTP target `mail2news.tcpreset.net:25`.
+- `pietro` runs `n2usenet.service` with authenticated SMTP submission to
+  `51.178.55.22:587` through Nym and verifies `mail.virebent.art` in TLS.
 - `pietro` uses `n2usenet@virebent.art` as the SMTP envelope sender.
-- `cmd/n2u-check` completed SMTP greeting, EHLO, STARTTLS, and TLS 1.3 through
-  the live Nym path on 2026-07-13.
+- `victor` Postfix relays to `mail2news@mail2news.tcpreset.net` with the
+  domain's SPF, DKIM, and DMARC policy.
 
 `identicons-cli` is already available on `victor` at `/usr/local/bin/identicons-cli`.
 Its output was checked against the `Ch1ffr3punk/identicons` engine using