admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

report: hub /notify verified end-to-end on new key; Gmail (S4) done; only S7 (delete old key) remains

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-06-29 08:03:31 +02:00
parent 3044965a9b
commit 4b97855cdd
1 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+11 -11
View File
@@ -53,21 +53,21 @@ the live cluster confirmed to carry the **old** key before the change (hash matc
|-------|--------|
| New key send-capable | ✅ Resend `POST /emails` from host 180 → **HTTP 200**, id `79df5b65…` |
| contact-mailer end-to-end | ✅ form POST → **HTTP 200**; pod log `[OK] Email sent: resend_id=c13d86ae…` (new key via `resend-api`) |
| hub | ✅ running pod env `RESEND_API_KEY` = **new** key (hash match) + uses the identical, now-proven Resend send path; `Healthy`. A literal `/notify` was **not** fired — it emails a real customer in Hungarian and no operator-owned target was readable without the DB. Can run a live hub send on request. |
| Gmail | ⏳ **operator-manual (S4)** — update "Send mail as" SMTP password to the new key |
| hub | ✅ **end-to-end** `/notify` (event_type=`test`) → log `Notification email sent to nagyfenyvesi.viktor@gmail.com`, `{"sent":true}`. Sent via `Secret/resend-api` (new key). Used a throwaway prefs row `_resend-rotation-test`, then **blanked it** (follow-up notify → `sent:false, no_email`). |
| Gmail | ✅ **S4 done** — operator updated "Send mail as" SMTP password; confirmed test mail arrives. |
(All test mail was sent to `info@felhom.eu` from the verified `felhom.eu` domain. Operator confirms inbox
arrival.)
(contact-mailer/direct-key test mail went to `info@felhom.eu`; the hub test went to the operator's Gmail.
Operator confirmed arrival of both.)
## STOP — §13 gate (operator action required before S7)
## STOP — §13 gate (only S7 remains — operator action)
**Do not delete the old key in Resend (S7) until:**
1. **Gmail "Send mail as" (S4)** is updated to the new key — otherwise S7 breaks Gmail send. Gmail is the
one remaining consumer still on the old key.
2. You've confirmed the two test emails above (+ a Gmail test send) arrived.
All consumers (hub, contact-mailer, Gmail) verified sending on the **new** key. The one remaining,
irreversible step is **operator-only**:
Then delete the old key in Resend and re-verify one consumer still sends (proves nothing was left on the
old key). After that, this can be marked fully closed.
- **S7 — delete the OLD key in Resend** (dashboard → API Keys). Then re-verify one consumer still sends
(e.g. submit the contact form again) to prove nothing was left on the old key.
After S7 + re-verify, the rotation is fully closed (only the S8 history-scrub remains, deferred).
## S8 — history scrub (deferred)