admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: REPORT — hub v0.18.0 deployed + live relay validated

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-06-29 08:58:06 +02:00
parent 2e749741b8
commit 576f4ca88b
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+12 -6
View File
@@ -36,12 +36,18 @@
through). PASS.
- Send-failure→502, 401/503/400 paths, token-bucket unit (injected clock), LOGIN auth + From-domain parse. PASS.
### Deployment & live validation
- **Deploy:** build `felhom-hub:0.18.0` on 180 → bump `manifests/hub.yaml` image → ArgoCD sync (auto-sync off).
The `mail` config is optional (defaults 30/min, `felhom.eu`); the Resend key is already injected via
`Secret/resend-api` (`RESEND_API_KEY`), so the relay activates on deploy.
- **End-to-end (app → shim → hub → Resend → real inbox):** result recorded here after the live run; method
stated. The Resend key is supplied to the hub out-of-band — never on the guest, never committed.
### Deployment & live validation — DONE (2026-06-29)
- **Deployed** `felhom-hub:0.18.0`: built on 180 → bumped `manifests/hub.yaml` → ArgoCD `felhom` app hard-refresh
+ sync (auto-sync off). Rollout OK; live image `…felhom-hub:0.18.0`; startup log:
`[INFO] App-email relay enabled (limit 30/min/customer, From domains [felhom.eu])`. The Resend key is injected
from `Secret/resend-api` (`RESEND_API_KEY`); no key in any committed file.
- **End-to-end (app → on-box shim → hub → Resend):** a raw MIME message with an inline CID image, From
`vaultwarden@felhom.eu`, was relayed from guest 9201's shim through this hub to the live Resend account. Hub
log: `/api/v1/mail: relayed for demo-felhom (from=vaultwarden@felhom.eu rcpts=1 bytes=789)`; the box's shim got
`hub=200` and returned `DATA 250 "OK: queued"` to the sender (Resend accepted/queued for the verified
`felhom.eu` domain). Operator inbox arrival is the final confirmation (sent to the operator's own address).
- **Security backstop (live):** a send From `evil@notfelhom.example` was rejected at the box's shim (`550`) before
ever reaching `/api/v1/mail` — the hub From-allowlist + rate-limit are the documented second backstop.
### Observations
- App-relay is a **separate** code path from the hub's own structured alerts (which keep using the Resend