admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

report: hub /notify verified end-to-end on new key; Gmail (S4) done; only S7 (delete old key) remains

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-06-29 08:03:31 +02:00
parent 3044965a9b
commit 4b97855cdd
1 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+11 -11
View File
@@ -53,21 +53,21 @@ the live cluster confirmed to carry the **old** key before the change (hash matc
|-------|--------| |-------|--------|
| New key send-capable | ✅ Resend `POST /emails` from host 180 → **HTTP 200**, id `79df5b65…` | | New key send-capable | ✅ Resend `POST /emails` from host 180 → **HTTP 200**, id `79df5b65…` |
| contact-mailer end-to-end | ✅ form POST → **HTTP 200**; pod log `[OK] Email sent: resend_id=c13d86ae…` (new key via `resend-api`) | | contact-mailer end-to-end | ✅ form POST → **HTTP 200**; pod log `[OK] Email sent: resend_id=c13d86ae…` (new key via `resend-api`) |
| hub | ✅ running pod env `RESEND_API_KEY` = **new** key (hash match) + uses the identical, now-proven Resend send path; `Healthy`. A literal `/notify` was **not** fired — it emails a real customer in Hungarian and no operator-owned target was readable without the DB. Can run a live hub send on request. | | hub | ✅ **end-to-end** `/notify` (event_type=`test`) → log `Notification email sent to nagyfenyvesi.viktor@gmail.com`, `{"sent":true}`. Sent via `Secret/resend-api` (new key). Used a throwaway prefs row `_resend-rotation-test`, then **blanked it** (follow-up notify → `sent:false, no_email`). |
| Gmail | ⏳ **operator-manual (S4)** — update "Send mail as" SMTP password to the new key | | Gmail | ✅ **S4 done** — operator updated "Send mail as" SMTP password; confirmed test mail arrives. |
(All test mail was sent to `info@felhom.eu` from the verified `felhom.eu` domain. Operator confirms inbox (contact-mailer/direct-key test mail went to `info@felhom.eu`; the hub test went to the operator's Gmail.
arrival.) Operator confirmed arrival of both.)
## STOP — §13 gate (operator action required before S7) ## STOP — §13 gate (only S7 remains — operator action)
**Do not delete the old key in Resend (S7) until:** All consumers (hub, contact-mailer, Gmail) verified sending on the **new** key. The one remaining,
1. **Gmail "Send mail as" (S4)** is updated to the new key — otherwise S7 breaks Gmail send. Gmail is the irreversible step is **operator-only**:
one remaining consumer still on the old key.
2. You've confirmed the two test emails above (+ a Gmail test send) arrived.
Then delete the old key in Resend and re-verify one consumer still sends (proves nothing was left on the - **S7 — delete the OLD key in Resend** (dashboard → API Keys). Then re-verify one consumer still sends
old key). After that, this can be marked fully closed. (e.g. submit the contact form again) to prove nothing was left on the old key.
After S7 + re-verify, the rotation is fully closed (only the S8 history-scrub remains, deferred).
## S8 — history scrub (deferred) ## S8 — history scrub (deferred)