# neomutt-config

Security-focused NeoMutt configuration with multi-account support and anonymous Usenet posting via a mail2news gateway over Tor.

Full write-up: [Posting to Usenet Anonymously with NeoMutt and Mail2News over Tor](https://virebent.art/blog/neomutt-mail2news.html)

---

## Features

- Multi-account IMAP/SMTP (STARTTLS, port 143/587)
- **GnuPG support** — PGP signing/encryption for regular email (configured in `neomuttrc.common`)
- **Mail2news via Tor** — post to Usenet through a `.onion` SMTP gateway, no IP exposed
- **Optional YubiKey PIV Ed25519 signatures** — hardware-backed signing for Usenet posts (alternative to GnuPG)
- F7/F9 macro → interactive post script (newsgroup, subject, editor, review, send)
- Ephemeral `.invalid` From address for anonymous posting
- No IMAP for the mail2news account — send-only

---

## Requirements

| Package    | Purpose                       | Required |
|------------|-------------------------------|----------|
| `neomutt`  | MUA                           | Yes      |
| `gnupg`    | PGP signing/encryption        | Yes      |
| `tor`      | Tor daemon (127.0.0.1:9050)   | For Usenet posting |
| `torsocks` | Tor proxy wrapper             | For Usenet posting |
| `swaks`    | SMTP test/send tool           | Optional |
| `vim`      | Message editor                | Yes      |
| `yubisigner-cli` | YubiKey PIV signing      | Optional |

On Arch:
```bash
pacman -S neomutt gnupg tor torsocks vim
```

On Debian/Ubuntu:
```bash
apt install neomutt gnupg tor torsocks vim
```

### Signing options

**Option 1: GnuPG (default, recommended)**

GnuPG is pre-configured in `neomuttrc.common`. Set your key ID:
```bash
# Edit ~/.config/neomutt/neomuttrc.common and set:
set pgp_sign_as = "0xYOURKEYID"
set pgp_default_key = "0xYOURKEYID"
```

NeoMutt will prompt for signing/encryption when composing messages.

**Option 2: YubiKey PIV Ed25519 (optional, for Usenet posts)**

For hardware-backed signatures on Usenet posts via mail2news:

1. Configure YubiKey PIV slot 9c with Ed25519 key (one-time setup)
2. Install [yubisigner-cli](https://git.virebent.art/virebent/yubisigner-cli):
   ```bash
   cd ~/bin
   git clone https://git.virebent.art/virebent/yubisigner-cli
   cd yubisigner-cli
   go build -o yubisigner-cli main.go
   ```
3. Install signing scripts from this repo:
   ```bash
   mkdir -p ~/bin
   cp scripts/vim-yubisigner ~/bin/
   cp scripts/yubisigner-with-pinentry ~/bin/
   chmod +x ~/bin/vim-yubisigner ~/bin/yubisigner-with-pinentry
   ```

The `accounts/mail2news` file is pre-configured to use `vim-yubisigner`. If you don't have YubiKey, edit the file and change:
```
set editor = "vim"
```

**Option 3: No signing**

Comment out or remove GnuPG settings from `neomuttrc.common` and use plain vim for mail2news.

---

## Installation

```bash
git clone https://git.virebent.art/virebent/neomutt-config
cd neomutt-config

mkdir -p ~/.config/neomutt/accounts
cp neomuttrc.common ~/.config/neomutt/neomuttrc.common
cp neomuttrc.tor    ~/.config/neomutt/neomuttrc.tor
cp colors.mutt      ~/.config/neomutt/colors.mutt
cp mailcap          ~/.config/neomutt/mailcap
cp accounts/mail2news ~/.config/neomutt/accounts/mail2news
cp scripts/m2n-prompt.sh ~/.config/neomutt/m2n-prompt.sh
chmod +x ~/.config/neomutt/m2n-prompt.sh
```

---

## Mail2news usage

Start Tor, then launch NeoMutt through the Tor profile:

```bash
torsocks neomutt -F ~/.config/neomutt/neomuttrc.tor
```

Press **F9** from the index or pager. Answer the prompts:

```
Newsgroup(s): misc.test
Subject:      test post
```

Write your message in the editor, review the draft, send.

The post goes to `mail2news@xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion`,
which forwards to the NNTP server and propagates from there.

**Posts are automatically signed** with YubiKey PIV Ed25519 in PGP-like clearsign format if `vim-yubisigner` is configured.

### Send directly from the shell (no NeoMutt)

```bash
torsocks swaks \
    --server qee4i7sags6phsvb2yodwecfj7noimfhhalsjktsvikrwotxzis3raad.onion:25 \
    --from   nobody@virebent.invalid \
    --to     mail2news@xilb7y4kj6u6qfo45o3yk2kilfv54ffukzei3puonuqlncy7cn2afwyd.onion \
    --header "Newsgroups: misc.test" \
    --header "Subject: test post" \
    --body   "This is a test."
```

---

## File layout

```
~/.config/neomutt/
├── neomuttrc              # main profile (clearnet accounts)
├── neomuttrc.common       # shared UI/GPG/sidebar settings
├── neomuttrc.tor          # Tor profile — sources mail2news account, F9 macro
├── colors.mutt            # color theme
├── mailcap                # MIME handlers
├── m2n-prompt.sh          # mail2news posting script (called by F9)
└── accounts/
    ├── account1           # example IMAP/SMTP account
    ├── account2
    ├── account3
    └── mail2news          # send-only, onion SMTP, ephemeral From
```

---

## Keybindings

| Key   | Action                  |
|-------|-------------------------|
| F2    | Switch to account 1     |
| F3    | Switch to account 2     |
| F4    | Switch to account 3     |
| F9    | Post to Usenet          |
| B     | Toggle sidebar          |

---

## Gateway address

The mail2news gateway on `virebent.art` accepts unauthenticated SMTP on port 25
and forwards to Peanny NNTP (`peannyjkqwqfynd24p6dszvtchkq7hfkwymi5by5y332wmosy5dwfaqd.onion`) over Tor. 
Full onion circuit.
```