felhom.eu/documentation/audits/mailer-source-2026-10-08/SEARCH.md

# The contact mailer's source — the search (2026-10-08)

**Result: NOT FOUND.** Read only on DooPlex: no restart, no deploy, no image tag, no change to the pod.

## Part A — the program's own clues

| Clue | Value | Source |
|---|---|---|
| Module | `github.com/felhom/contact-mailer` `(devel)` | `go version -m` → `go-version-m.txt` |
| Go | go1.23.12, `CGO_ENABLED=0`, `-ldflags="-w -s"` | same |
| `vcs.revision` / `vcs.time` / `vcs.modified` | **absent** — not built inside a git folder (or with VCS stamping off) | same |
| Source file | **one file: `/build/main.go`** (the only non-stdlib `.go` path in the binary) | `strings` |
| Image | `docker.io/library/contact-mailer:latest`, index `sha256:fac420fd…`, built **2026-02-05 10:40 +01:00** by BuildKit; multi-stage: a builder stage with `/build`, then alpine 3.20.9 + `ca-certificates tzdata`, user `appuser` 1000, `WORKDIR /app`, `COPY /build/contact-mailer .` | `k3s ctr content get` → `image-config.json` |
| Provenance | the index names an SLSA provenance blob (`sha256:f4ad3f62…`) — **not present** in containerd (`ctr content get`: not found) | — |

The binary itself is kept here (`contact-mailer.bin`, sha256 in `contact-mailer.bin.sha256`; no API key inside — a
search for `re_…`, `Bearer re_`, `sk-`, `ghp_` found 0): if DooPlex is rebuilt, this is the only copy of the program.

## Part B — where it was searched (each with its positive control)

| # | Place | Result | Positive control |
|---|---|---|---|
| 1 | Paths from Part A (`/build`) | none on DooPlex (`/build` does not exist; it was the build container's folder) | — |
| 2 | Web editor (`code-system/code-server`, Longhorn PVCs `code-server-workspace`/`-config`/`-local`, read through the running pod): `grep -r` for `sendViaResend`, `buildEmailHTML`, `felhom/contact-mailer` in `*.go`, `go.mod`, `Dockerfile*` under `/home/coder`; name search `*contact*mailer*`; the editor's file history `~/.local/share/code-server/User/History` (34 MB) without a type filter | only `felhom.eu/manifests/contact-mailer.yaml` | `func main` found in `felhom-agent/cmd/felhom-opsign/main.go` and in two History `.go` copies |
| 3 | Gitea: all 10 repositories the two tokens see (`admin/*`; no other owner visible), full history, `git log --all -G 'sendViaResend\|buildEmailHTML\|felhom/contact-mailer'` | hits only in manifests: `homelab-manifests` c9648cd (2026-02-05 „added mailer pod", deleted ee93b50) and `felhom.eu` 0b144a4d | the same search finds the manifests (which name `…/felhom/contact-mailer`) |
| 4 | DooPlex disks, whole (`/`, `/mnt/1_hdd`, `2_hdd`, `3_hdd`, `5_hdd`, `ssd_2`), `nice -n 19 ionice -c3`: name search `*contact-mailer*`/`*contact_mailer*`, no depth limit; content search of 55,548 `*.go`/`go.mod`/`Dockerfile*` files for `sendViaResend\|buildEmailHTML\|felhom/contact-mailer\|RESEND_API_KEY\|contact-mailer\|contact_mailer` (`search.sh`, `disk-search.txt`) | names: the manifest and the pod's own logs only; content: only `hub/cmd/hub/main.go` (×2) | `RESEND_API_KEY` found in the hub's `main.go` (both copies) |
| 5 | Docker build cache (`docker buildx du --verbose`, 337 records) and build history (`docker buildx history ls`) | oldest cache record 2026-09-28, history 7 days — the February build is gone; no dangling image | the lists hold today's builds |

**Excluded by name** (fences or no source possible): `/proc /sys /dev /run`, `/var/lib/{docker,containerd,
containerd.pre-move-2026-08-05,rancher,kubelet,longhorn,proxmox-backup}`, `/mnt/ssd_2/{replicas,containerd}`,
`/mnt/backup-longhorn`, any `.chunks` (PBS), media folders (`Download Series Movies Cartoons Kids Audiobook Photos
Videos "Phone Backup"`, `/mnt/plex_media`), `lost+found`, the session scratchpad. Gitea's and the registry's own
storage live in k3s/Longhorn volumes and were not read directly (Gitea was read through its API).

**Not reachable from here:** the operator's Windows workstation (`e:\DooPlex Server\` holds DooPlex deploy notes per
project memory). The manifest's own comment says `docker build -t contact-mailer:latest .`, then
`docker save … | sudo k3s ctr images import -` — a build on a machine with k3s, so DooPlex, from a folder that no
longer exists here.

## A side finding

`homelab-manifests` history (c9648cd, 2026-02-05) holds a Resend API key literal in the old manifest's comment. Compared
by hash only (never printed): it is **not** today's key (`Secret/resend-api`), which was rotated 2026-06-29 (felhom.eu
feea0606). No row: the key was already replaced.