[codex] Open IPv4 IMAPS on mail

[Svaag]

Changes: exposes Dovecot IMAPS on 993/tcp over the dedicated mail IPv4 while keeping IPv6 IMAPS scoped to ops/VPN/mon/noc; updates the rendered PF artifact and network flow docs. Validation: local firewall validate, firewall syntax-check, deploy preflight, CI dry-run https://github.com/AS215932/network-operations/actions/runs/28291330456, live apply https://github.com/AS215932/network-operations/actions/runs/28291354795, and external IPv4 nc/TLS checks against mail.as215932.net:993 succeeded.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🏅 Score: 95

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Operational Risk The new IPv4 IMAPS rule (line 32) uses $ext_ifs (both xnf0 and xnf1) but the dedicated mail IPv4 is only on xnf1. If xnf0 also carries a public IPv4, this opens IMAPS on an interface that may not be intended for mail traffic, widening the attack surface beyond the stated "dedicated failover IPv4" scope. The host_vars comment says "dedicated failover IPv4" but the PF rule applies to all external interfaces. pass in quick on $ext_ifs inet proto tcp from any to any port = 993 keep state label "IMAPS public IPv4 (Dovecot)"

[github-actions]

PR Code Suggestions ✨

No code suggestions found for the PR.