felhom.eu/documentation/audits/mailer-source-2026-10-08/SEARCH.md

The contact mailer's source — the search (2026-10-08)

Result: NOT FOUND. Read only on DooPlex: no restart, no deploy, no image tag, no change to the pod.

Part A — the program's own clues

Clue	Value	Source
Module	github.com/felhom/contact-mailer (devel)	go version -m → go-version-m.txt
Go	go1.23.12, CGO_ENABLED=0, -ldflags="-w -s"	same
vcs.revision / vcs.time / vcs.modified	absent — not built inside a git folder (or with VCS stamping off)	same
Source file	one file: /build/main.go (the only non-stdlib .go path in the binary)	strings
Image	docker.io/library/contact-mailer:latest, index sha256:fac420fd…, built 2026-02-05 10:40 +01:00 by BuildKit; multi-stage: a builder stage with /build, then alpine 3.20.9 + ca-certificates tzdata, user appuser 1000, WORKDIR /app, COPY /build/contact-mailer .	k3s ctr content get → image-config.json
Provenance	the index names an SLSA provenance blob (sha256:f4ad3f62…) — not present in containerd (ctr content get: not found)	—

The binary itself is kept here (contact-mailer.bin, sha256 in contact-mailer.bin.sha256; no API key inside — a search for re_…, Bearer re_, sk-, ghp_ found 0): if DooPlex is rebuilt, this is the only copy of the program.

Part B — where it was searched (each with its positive control)

#	Place	Result	Positive control
1	Paths from Part A (/build)	none on DooPlex (/build does not exist; it was the build container's folder)	—
2	Web editor (code-system/code-server, Longhorn PVCs code-server-workspace/-config/-local, read through the running pod): grep -r for sendViaResend, buildEmailHTML, felhom/contact-mailer in *.go, go.mod, Dockerfile* under /home/coder; name search *contact*mailer*; the editor's file history ~/.local/share/code-server/User/History (34 MB) without a type filter	only felhom.eu/manifests/contact-mailer.yaml	func main found in felhom-agent/cmd/felhom-opsign/main.go and in two History .go copies
3	Gitea: all 10 repositories the two tokens see (admin/*; no other owner visible), full history, git log --all -G 'sendViaResend|buildEmailHTML|felhom/contact-mailer'	hits only in manifests: homelab-manifests c9648cd (2026-02-05 „added mailer pod", deleted ee93b50) and felhom.eu 0b144a4d	the same search finds the manifests (which name …/felhom/contact-mailer)
4	DooPlex disks, whole (/, /mnt/1_hdd, 2_hdd, 3_hdd, 5_hdd, ssd_2), nice -n 19 ionice -c3: name search *contact-mailer*/*contact_mailer*, no depth limit; content search of 55,548 *.go/go.mod/Dockerfile* files for sendViaResend|buildEmailHTML|felhom/contact-mailer|RESEND_API_KEY|contact-mailer|contact_mailer (search.sh, disk-search.txt)	names: the manifest and the pod's own logs only; content: only hub/cmd/hub/main.go (×2)	RESEND_API_KEY found in the hub's main.go (both copies)
5	Docker build cache (docker buildx du --verbose, 337 records) and build history (docker buildx history ls)	oldest cache record 2026-09-28, history 7 days — the February build is gone; no dangling image	the lists hold today's builds

Excluded by name (fences or no source possible): /proc /sys /dev /run, /var/lib/{docker,containerd, containerd.pre-move-2026-08-05,rancher,kubelet,longhorn,proxmox-backup}, /mnt/ssd_2/{replicas,containerd}, /mnt/backup-longhorn, any .chunks (PBS), media folders (Download Series Movies Cartoons Kids Audiobook Photos Videos "Phone Backup", /mnt/plex_media), lost+found, the session scratchpad. Gitea's and the registry's own storage live in k3s/Longhorn volumes and were not read directly (Gitea was read through its API).

Not reachable from here: the operator's Windows workstation (e:\DooPlex Server\ holds DooPlex deploy notes per project memory). The manifest's own comment says docker build -t contact-mailer:latest ., then docker save … | sudo k3s ctr images import - — a build on a machine with k3s, so DooPlex, from a folder that no longer exists here.

A side finding

homelab-manifests history (c9648cd, 2026-02-05) holds a Resend API key literal in the old manifest's comment. Compared by hash only (never printed): it is not today's key (Secret/resend-api), which was rotated 2026-06-29 (felhom.eu feea0606). No row: the key was already replaced.