# YAMN Web

YAMN Web is a send-only web interface for email and Usenet delivery through
the YAMN remailer network. The active path encrypts the message locally with a
Go YAMN v2 encoder, then transports only the opaque envelope through Nym.

The service is intentionally limited to message submission. It has no inbox,
fetch, view, reply retrieval, AEC, or message-storage feature.

## Active architecture

```text
Browser
  -> HTTPS or Onion service
  -> PHP application
  -> local Go YAMN encoder
  -> encrypted YAMN envelope
  -> persistent Rust Nym sender with bounded RAM queue
  -> Nym ingress service
  -> Tor SMTP connection to the selected YAMN Entry
  -> YAMN Entry -> Middle -> Exit
  -> email recipient, or Mail-to-News -> Usenet
```

The Nym sender and ingress receive only:

- the selected YAMN Entry address;
- the complete, already encrypted YAMN envelope.

They do not receive the message body, subject, or final recipient as separate
transport fields. The normal submission path does not write message payloads
or queued envelopes to temporary files.

## Repository layout

- `index.php`: unified email and Usenet composer.
- `yamn_encoder.php`: PHP boundary for the local Go encoder.
- `nym_sender.php`: PHP client for the local persistent Nym sender socket.
- `download_remailers.php`: freshness-aware remailer statistics and public-key
  refresh through Tor.
- `about.html`: public architecture and privacy description.
- `yamn/`: active Go YAMN v2 encoder and JSON helper.
- `nym/`: active Rust Nym sender, including daemon and compatibility one-shot
  modes.
- `ingress/`: Rust Nym recipient and allowlisted Tor SMTP forwarder.
- `deploy/`: systemd units and non-secret environment examples.

The application uses the downloaded remailer statistics in
`/opt/yamn-data/cache/remailers.txt`. The repository copy of `remailers.txt`
is a local fallback for development and initial deployment.

## Build and test

### YAMN encoder

```sh
cd yamn
GOCACHE=/tmp/yamnweb-go-build go test ./...
GOCACHE=/tmp/yamnweb-go-build go vet ./...
go build -o yamn-encode ./cmd/yamn-encode
```

### Nym sender

```sh
cd nym
cargo fmt --check
cargo test
cargo clippy --all-targets -- -D warnings
cargo build --release
```

### Nym ingress

```sh
cd ingress
cargo fmt --check
cargo test
cargo clippy --all-targets -- -D warnings
cargo build --release
```

### PHP

```sh
php -l index.php
php -l yamn_config.php
php -l yamn_encoder.php
php -l nym_sender.php
php -l download_remailers.php
```

## Production configuration

Configuration belongs in `/etc/yamnweb/yamnweb.env`, not in the repository.
The web application reads it through `yamn_config.php`.

Required settings include:

```ini
YAMN_ENCODER=/usr/local/bin/yamn-encode
YAMN_PUBRING=/opt/yamn-master/pubring.mix
YAMN_USENET_GATEWAY=mail2news@mail2news.tcpreset.net
YAMN_NYM_RECIPIENT=<nym-ingress-recipient>
YAMN_NYM_STORAGE=/var/lib/yamnweb/nym-client
YAMN_NYM_SOCKET=/run/yamnweb/nym-sender.sock
YAMN_NYM_QUEUE_CAPACITY=8
```

`YAMN_NYM_RECIPIENT` is a Nym address, not an SMTP address. The selected YAMN
Entry is encoded in the transport request and must match the ingress
allowlist.

The sender daemon is installed from `deploy/yamn-nym-sender.service`. It is the
sole owner of the persistent Nym SDK storage and exposes a mode-`0600` Unix
socket inside a mode-`0700` runtime directory. Its queue capacity is restricted
to 1 through 64 entries and queued envelopes remain only in memory.

The ingress is installed separately from `deploy/yamn-nym-ingress.service`.
Its environment file must contain the reviewed current YAMN Entry allowlist.
Public YAMN exits deliver to the clearnet Mail-to-News endpoint; they must not
be configured with an Onion-only destination they cannot resolve or reach.
The ingress retries transient Tor connection failures only before beginning
the SMTP transaction, avoiding both immediate message loss and unsafe retry
after an ambiguous SMTP handoff.

## Delivery semantics

A successful web response means that the local Nym sender accepted the opaque
envelope into its bounded queue. It does not prove final delivery. Nym and YAMN
queues introduce variable delays, and this send-only application does not read
the recipient or Usenet server to confirm arrival.

Operational delivery checks must correlate payload-free handoff timestamps
across the Nym ingress, Mail-to-News gateway, and NNTP article counters. Do not
record message bodies, final recipients, subjects, encrypted envelopes, or
Nym payloads in logs.

## Security notes

- All form input is validated before encoding.
- Usenet `References` accepts a bounded chain of Message-IDs and generates
  `In-Reply-To` from the last ID; `Reply-To` is validated as an email address.
- The YAMN encoder reads only the local reviewed public keyring.
- The Nym recipient and Mail-to-News address are deployment configuration,
  never browser-controlled destinations.
- The ingress accepts only explicitly allowlisted YAMN Entry addresses.
- The active path keeps payloads in process memory and the bounded sender
  queue, without a disk spool.
- Examples contain no credentials, private keys, Nym identities, or service
  secrets.

The detailed public explanation is available in `about.html`.