publics/consolecrypt
1
0
Fork 0
Code Issues Pull requests Projects Releases 3 Packages Activity Actions

WIP: Draft: server: private SMTP configuration and security hardening #3

Merged
root merged 3 commits from codex/server-config-audit into main 2026-10-01 15:49:03 +03:00
Conversation 2 Commits 3 Files changed 31 +835 -67
root commented 2026-10-01 14:38:24 +03:00 (Migrated from git.evsikov.net)
Copy link

Add private SMTP/server configuration for native installations using --config or CC_CONFIG_FILE, with environment overrides and a strict JSON allowlist. Docker Compose reads a private server.env and pins the verified server 0.1.11 image; production SMTP remains a Kubernetes Secret reference.

Harden database/SMTP diagnostics against credential-bearing errors, prevent timestamp-overflow failures, and close WebSocket sessions with transient 1011 when validity cannot be checked. No protocol or migration changes. Server 0.1.11, chart 0.1.13.

Validation: 176 Rust tests with required disposable PostgreSQL; 13 Python/Helm tests; Clippy -D warnings; current RustSec check passed. Both linux/amd64 and linux/arm64 passed readiness, version/source provenance, API authentication and absence of website routes. Disposable Compose verification passed 13 checks including SMTP punctuation handling, HTTPS, backup/restore and volume persistence.

Job1267 passed and published runtime commit960d0b6 to registry.evsikov.net/publics/consolecrypt/server@sha256:7387d10a7e6e62d161e0154ce064a6ebe15999c338f33bb5df80691aca745301. The final deploy-only commit0b419e7 updates examples to this immutable image. Production Helm15 is healthy; existing SMTP, strict proofs and sharing flags were preserved, and PostgreSQL was not restarted.

Image audit: no embedded secrets found. Pinned Debian12 Distroless still has45 OS advisory entries (1high;7 with upstream fixes). The high OpenSSL DTLS issue has no observed application path: TLS uses Rustls and no DTLS. This residual dependency risk remains documented.

Keep draft while Client Dev assembles client0.2.1 and integrates the three scoped commits.

Add private SMTP/server configuration for native installations using --config or CC_CONFIG_FILE, with environment overrides and a strict JSON allowlist. Docker Compose reads a private server.env and pins the verified server 0.1.11 image; production SMTP remains a Kubernetes Secret reference. Harden database/SMTP diagnostics against credential-bearing errors, prevent timestamp-overflow failures, and close WebSocket sessions with transient 1011 when validity cannot be checked. No protocol or migration changes. Server 0.1.11, chart 0.1.13. Validation: 176 Rust tests with required disposable PostgreSQL; 13 Python/Helm tests; Clippy -D warnings; current RustSec check passed. Both linux/amd64 and linux/arm64 passed readiness, version/source provenance, API authentication and absence of website routes. Disposable Compose verification passed 13 checks including SMTP punctuation handling, HTTPS, backup/restore and volume persistence. Job1267 passed and published runtime commit960d0b6 to registry.evsikov.net/publics/consolecrypt/server@sha256:7387d10a7e6e62d161e0154ce064a6ebe15999c338f33bb5df80691aca745301. The final deploy-only commit0b419e7 updates examples to this immutable image. Production Helm15 is healthy; existing SMTP, strict proofs and sharing flags were preserved, and PostgreSQL was not restarted. Image audit: no embedded secrets found. Pinned Debian12 Distroless still has45 OS advisory entries (1high;7 with upstream fixes). The high OpenSSL DTLS issue has no observed application path: TLS uses Rustls and no DTLS. This residual dependency risk remains documented. Keep draft while Client Dev assembles client0.2.1 and integrates the three scoped commits.
root commented 2026-10-01 14:55:02 +03:00 (Migrated from git.evsikov.net)
Copy link

added 1 commit

  • 0b419e79 - chore(server): pin audited self-host image 0.1.11

Compare with previous version

added 1 commit <ul><li>0b419e79 - chore(server): pin audited self-host image 0.1.11</li></ul> [Compare with previous version](/publics/consolecrypt/-/merge_requests/3/diffs?diff_id=131&start_sha=960d0b6cf02367d2afa9813db7b8b3b5fd3ad7a2)
root commented 2026-10-01 14:56:15 +03:00 (Migrated from git.evsikov.net)
Copy link

changed the description

changed the description
root (Migrated from git.evsikov.net) merged commit 0b419e796f into main 2026-10-01 15:49:03 +03:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
publics/consolecrypt!3
No description provided.