The command API, which refuses everything until it knows who is asking

novox/hq ADR 0035: one implementation, several surfaces, and a surface holds no decisions. The act of assigning — including that an assignment which does not resolve is kept and still refused — moved into acts.go, and the command line now calls it too. Two surfaces, one refusal, in the same words. It will not run without --issuer, and refuses at start rather than per request so it is found by whoever ran it rather than by whoever finds it. There is no flag that removes the check. The authenticator is honest about what it is: no token can be verified until an identity provider exists, because that is a module and none is running, so every request is refused and told that the command line still works. A surface that functioned without authentication would be one somebody left running — and the board this stands behind is published on a public name. Four refusals, four tests. The last one first asserted "not 200", which passed because a request with no database fails at the store anyway — it proved nothing about whether the input was checked. It now asserts the specific refusal, and bites when the check is removed.
2026-09-01 01:55:56 +02:00
parent 8cf1ecf6a5
commit d0511ee3fe
10 changed files with 572 additions and 15 deletions
@@ -0,0 +1,90 @@
+{
+  "module": "mailu",
+  "version": "1",
+
+  "capabilities": ["container-runtime"],
+
+  "listens": [
+    {"port": 25, "protocol": "tcp", "from": "anywhere", "why": "mail from other mail servers"},
+    {"port": 465, "protocol": "tcp", "from": "anywhere", "why": "submission over TLS"},
+    {"port": 587, "protocol": "tcp", "from": "anywhere", "why": "submission"},
+    {"port": 993, "protocol": "tcp", "from": "anywhere", "why": "IMAP over TLS"},
+    {"port": 7080, "protocol": "tcp", "from": "mesh", "why": "the web interface, behind a proxy"}
+  ],
+
+  "own-secrets": {
+    "secret-key": "/var/lib/mailu/secret.env",
+    "database": "/var/lib/mailu/database.env",
+    "admin": "/var/lib/mailu/admin.env"
+  },
+
+  "resources": [
+    {"id": "state", "type": "directory", "path": "/var/lib/mailu", "mode": "0700"},
+
+    {"id": "net", "type": "network", "name": "mailu"},
+
+    {"id": "resolver", "type": "container", "name": "mailu-resolver",
+     "image": "mailu-unbound@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "network": "mailu",
+     "env-file": ["/var/lib/mailu/secret.env"]},
+
+    {"id": "redis", "type": "container", "name": "mailu-redis",
+     "image": "redis@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "network": "mailu",
+     "volumes": ["/services/mailu/data/redis:/data"]},
+
+    {"id": "admindb", "type": "container", "name": "mailu-admindb",
+     "image": "postgres@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "network": "mailu",
+     "env": {"PGDATA": "/var/lib/postgresql/data/pgdata"},
+     "env-file": ["/var/lib/mailu/database.env"],
+     "volumes": ["/services/mailu/data/data/psql_admindb/pgdata:/var/lib/postgresql/data/pgdata"]},
+
+    {"id": "admin", "type": "container", "name": "mailu-admin",
+     "image": "mailu-admin@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "network": "mailu",
+     "env-file": ["/var/lib/mailu/secret.env", "/var/lib/mailu/database.env", "/var/lib/mailu/admin.env"],
+     "volumes": [
+       "/services/mailu/data/data:/data",
+       "/services/mailu/data/dkim:/dkim"
+     ]},
+
+    {"id": "imap", "type": "container", "name": "mailu-imap",
+     "image": "mailu-dovecot@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "network": "mailu",
+     "env-file": ["/var/lib/mailu/secret.env"],
+     "volumes": [
+       "/services/mailu/data/mail:/mail",
+       "/services/mailu/data/overrides/dovecot:/overrides:ro"
+     ]},
+
+    {"id": "smtp", "type": "container", "name": "mailu-smtp",
+     "image": "mailu-postfix@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "network": "mailu",
+     "env-file": ["/var/lib/mailu/secret.env"],
+     "volumes": ["/services/mailu/data/mailqueue:/queue"]},
+
+    {"id": "antispam", "type": "container", "name": "mailu-antispam",
+     "image": "mailu-rspamd@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "network": "mailu",
+     "env-file": ["/var/lib/mailu/secret.env"],
+     "volumes": ["/services/mailu/data/filter:/var/lib/rspamd"]},
+
+    {"id": "webmail", "type": "container", "name": "mailu-webmail",
+     "image": "mailu-roundcube@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "network": "mailu",
+     "env-file": ["/var/lib/mailu/secret.env"],
+     "volumes": ["/services/mailu/data/webmail:/data"]},
+
+    {"id": "front", "type": "container", "name": "mailu-front",
+     "image": "mailu-nginx@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+     "network": "mailu",
+     "env-file": ["/var/lib/mailu/secret.env"],
+     "ports": ["25:25", "465:465", "587:587", "993:993", "7080:80"],
+     "volumes": [
+       "/services/mailu/data/certs:/certs",
+       "/services/mailu/data/overrides/nginx:/overrides:ro"
+     ],
+     "restart-on": ["imap", "smtp", "admin"]}
+  ]
+}