diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/architecture.md | 52 |
1 files changed, 46 insertions, 6 deletions
diff --git a/docs/architecture.md b/docs/architecture.md index 501903e..12a83da 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -8,6 +8,8 @@ - `internal/nymclient`: optional managed `nym-socks5-client` lifecycle. - `internal/socks5`: minimal SOCKS5 dialer used for Nym transport. - `internal/smtpclient`: SMTP + STARTTLS sender over an injected dialer. +- `internal/transporthealth`: cached background readiness state for the complete + SOCKS, SMTP, TLS, and AUTH path. - `internal/submit`: HTTP handlers, validation, message construction. - `internal/storage`: replay cache for Hashcash tokens. - `internal/assets/web`: embedded template and browser assets. @@ -23,20 +25,37 @@ kept only in tab memory and cleared after successful send. ## Transport Boundary -The app never dials `mail2news.tcpreset.net` directly when `N2U_NYM_ENABLED=true`. -All SMTP traffic goes through `N2U_NYM_SOCKS`, normally provided by -`nym-socks5-client`. +The app never dials an SMTP target directly when `N2U_NYM_ENABLED=true`. All +SMTP traffic goes through `N2U_NYM_SOCKS`, normally provided by +`nym-socks5-client`. The MTA boundary uses STARTTLS plus SMTP AUTH. Credentials +are loaded from a root-managed file, not embedded in source or command-line +arguments. SMTP AUTH, the SMTP envelope sender, and the RFC 5322 `Sender:` +header use the fixed N2Usenet service account. The public RFC 5322 `From:` +header instead contains the complete profile identity, `username <email>`, so +Mail2News and newsreaders do not replace it with the transport account. This +profile address is a pseudonymous claim bound to the VFACE tuple and public +key, not verification that the author controls the address domain. The intended posting chain is: ```text Browser -> HTTPS n2usenet.virebent.art N2Usenet -> Nym SOCKS5/requester -Nym requester -> mail2news.tcpreset.net:25 SMTP with STARTTLS +Nym requester -> 51.178.55.22:587 SMTP with STARTTLS + AUTH + (TLS name mail.virebent.art) +mail.virebent.art Postfix -> SPF/DKIM/DMARC signing and relay mail2news@mail2news.tcpreset.net -> Mail2News gateway -Mail2News gateway -> news.tcpreset.net NNTP +Mail2News -> Tor SOCKS +Mail2News -> peannyjkqwqfynd24p6dszvtchkq7hfkwymi5by5y332wmosy5dwfaqd.onion:119 NNTP +TCPReset INN -> news.tcpreset.net ``` +Nym and Tor protect different transport segments. Nym carries the +N2Usenet-to-MTA SMTP connection, with STARTTLS providing authenticated TLS +inside that path. After Postfix relays the message to Mail2News, Mail2News uses +Tor for the final connection to the onion NNTP endpoint. The final Usenet +article is public. + ## Deployment Boundary The current onion PHP app remains deployed under Onion Newsreader `/compose/`. @@ -46,5 +65,26 @@ in the current production deployment. Current production split: -- `victor` runs the dedicated Nym network requester. +- `victor` runs the dedicated Nym network requester and the authenticated + Postfix submission endpoint. - `pietro` runs the public HTTPS app and the local `nym-socks5-client`. + +The SOCKS destination is the MTA's global IPv4 address because local hostname +resolution on `victor` also returns interface-local addresses that the Nym +requester correctly rejects. TLS identity verification still uses +`mail.virebent.art`. + +## Operational Readiness + +`/healthz` is a liveness endpoint and does not imply that Nym can deliver. +`/readyz` exposes only the cached result of a periodic transport probe. The +probe performs SOCKS connection, SMTP greeting, STARTTLS, TLS verification, +post-TLS EHLO, and SMTP AUTH, then quits before `MAIL FROM`; it never sends a +message. Keeping the probe out of the request path prevents public health +requests from consuming Nym bandwidth. + +Nym gateway registrations are time-limited. The deployment timer runs once a +day and renews the active gateway only when it is within 24 hours of expiry. +The rotation is performed with the application and SOCKS services stopped, +backed up first, and accepted only after the same no-mail transport probe +succeeds. |