M8a Mail: Postfix + DKIM/DMARC implementation with integration tests#11
Closed
aidankhogg wants to merge 7 commits into
Closed
M8a Mail: Postfix + DKIM/DMARC implementation with integration tests#11aidankhogg wants to merge 7 commits into
aidankhogg wants to merge 7 commits into
Conversation
**Changes:** 1. **M1-M2 DNS Enhancement** - Add auth.internal, ca.internal, registry.internal stubs to root zone - Pre-registers L1 service records (best practice for M6+ DNS) - All M1-M2 tests still passing 2. **M6 Complete Rewrite (from skeleton to production-ready)** - Per-org Keycloak realms (maximum isolation) - User provisioning: seed from spec + event-driven org.admitted events - OIDC client credentials stored in Supabase for durability - Proper error handling, prerequisite validation, idempotence - Background event consumer for dynamic org provisioning - Comprehensive health checks with SSL verification - Event emission for causal tracing 3. **Architecture Improvements** - Proper spec model usage (spec.identity_inworld - not dict access) - Full context/DI pattern (no ad-hoc task creation) - Correct handler initialization (PKIHandler, DockerHandler, OIDCHandler) - Proper SSL context for OIDC discovery endpoint - Graceful degradation when pgmq unavailable (M1-M5 testing) 4. **Test Suite** - 16 new M6 integration tests (interface, prerequisites, realm creation, user provisioning, healthcheck, idempotence, events) - Updated M4-M5 skeleton tests to use new completion tracking API - All 68 M1-M6 tests passing **Design Decisions Locked:** - One realm per org (isolation) - User provisioning: seed from spec + event-driven - OIDC credentials: Supabase storage - DNS: auth.internal pre-registered by M1-M2 (not managed by M6) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VuzisGGSVDnV8fTHVsxjkv
- Implement Phase 7 Administrative Network Domain provisioning - Per-org AND creation with strict profile validation - Docker bridge network management with nftables rule application - Deterministic CIDR allocation for MVP - Event-driven provisioning for org.admitted events - 21 comprehensive integration tests with full coverage - Dual state tracking (RuntimeState + Supabase) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VuzisGGSVDnV8fTHVsxjkv
Implementation: - Mail handler: Full Postfix deployment with DKIM key generation (RSA 2048-bit) - DNS integration: SPF, DKIM, DMARC, MX record injection per org - Virtual mailbox provisioning for org users - Phase services: Enhanced M8 orchestration with mail/storage deployment - 21 comprehensive integration tests covering all mail functionality Fixes: - RuntimeState attribute correction: identity_platform_output (not platform_identity_output) - MailConfig DMARC default access: mailbox_policy.dmarc_default (not mail_config.dmarc_default) - Proper Pydantic v2 model instantiation for StorageConfig in tests Tests: - 21 M8a mail tests: All passing - 118 total integration tests: All passing (M1-M8, orchestrator) - No regressions in existing functionality Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VuzisGGSVDnV8fTHVsxjkv
Contributor
Author
|
Merged into ded/alpha (6c31513) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
M8a Mail Implementation: Complete ✅
Overview
Full production-ready implementation of Phase 8a (Mail Services) with Postfix SMTP server, DKIM/DMARC signing, and org-specific email infrastructure provisioning.
Changes
Mail Handler (
netengine/handlers/mail_handler.py)Phase Services Handler (
netengine/phases/phase_services.py)Integration Tests (
tests/integration/test_m8_mail.py)Bug Fixes
mailbox_policy.dmarc_default(notmail_config.dmarc_default)identity_platform_output(notplatform_identity_output)Test Results
Key Design Decisions
DKIM Implementation
DNS Records per Org
v=spf1 mx -all(default, configurable)v=DKIM1; k=rsa; p=<public_key>at_dkim._domainkey.<org>.internalv=DMARC1; p=reject(default, configurable)Virtual Mailbox Isolation
Files Modified
netengine/handlers/mail_handler.py(rewrite: 45 → 322 lines)netengine/phases/phase_services.py(enhance: 64 → 342 lines)tests/integration/test_m8_mail.py(new: 545 lines, 21 tests)Code Quality
Ready For
🤖 Generated with Claude Code
https://claude.ai/code/session_01VuzisGGSVDnV8fTHVsxjkv
Generated by Claude Code