fix(mail): route all outbound mail through local Stalwart SMTP; add DKIM and DNS records (#17)

* [live-apply] Woodpecker CI deployed — 0.179.47

Bump platform_version and repo_version to 0.179.47.
Update woodpecker live-apply receipt to reflect successful deployment of
Woodpecker CI (ci.0mpc.com) with OpenBao secret injection, Gitea OAuth
bootstrap, and seed repository activation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* [live-apply] DNS ledger and platform-service-watchdog deployed — 2026-05-26

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(mail-gateway): use per-profile SMTP credentials for local Stalwart delivery

The gateway's send_via_local_smtp was authenticating with a global
LOCAL_SMTP_USERNAME/PASSWORD env var, but Stalwart's must-match-sender
enforces that the authenticated user matches the FROM address. With three
profiles each sending from their own mailbox (alerts@, platform@, agents@)
this caused all local SMTP attempts to fail and fall through silently to Brevo.

Changes:
- app.py: load mailbox_password per profile in load_notification_profiles()
- app.py: use profile.mailbox_localpart + profile.mailbox_password as SMTP
  credentials in send_via_local_smtp; fall back to global env vars if absent
- app.py: disable SSL cert verification for local Stalwart (self-signed cert)
- defaults/main.yml: flip gateway defaults to attempt_local_first=true,
  force_brevo_fallback=false (local SMTP is now the primary path)
- defaults/main.yml: add mail_platform_dkim_* variables for DKIM key management
- stalwart-config.toml.j2: add conditional DKIM signing block
- tasks/main.yml: add task to deploy DKIM private key before Stalwart config render

All three profiles (operator-alerts, platform-transactional, agent-reports) now
route through local Stalwart SMTP and return channel=local_smtp on success.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(mail-dns): switch from Brevo to local Stalwart DKIM; retire Brevo DNS records

- inventory/host_vars/proxmox-host.yml: replace Brevo-specific DNS records with
  local DKIM (mail._domainkey TXT), fix SPF to "v=spf1 mx ~all" (remove Brevo
  include), mark brevo1/brevo2 CNAME and brevo-code TXT as absent for cleanup
- defaults/main.yml: add mail_platform_dkim_public_key variable (reads from
  .local/mail-platform/dkim-public-key.txt at runtime)

Running make converge-mail-platform now sets all mail DNS records for
deliverability without Brevo dependency. The bootstrap playbook
(playbooks/mail-platform.yml) handles the full DNS + runtime converge.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(mail-dns): add dkim_dns_value variable with proper 255-char chunking

DNS TXT records are limited to 255 chars per string. The DKIM public key
(392 chars) plus the prefix (18 chars) totals 410 chars. Add
mail_platform_dkim_dns_value in role defaults that splits the value into
two quoted strings per DNS convention: "v=DKIM1; k=rsa; p=<chunk1>" "<chunk2>"

Use mail_platform_dkim_dns_value in the inventory mail._domainkey record
so make converge-mail-platform is idempotent on future runs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: baditaflorin

collections/ansible_collections/lv3/platform/roles/mail_platform_runtime/defaults/main.yml

@@ -63,8 +63,22 @@ mail_platform_brevo_sender_email: operator@example.com
 mail_platform_brevo_sender_name: Florin Mail Bridge
 mail_platform_reply_to_email: "{{ mail_platform_mailbox_address }}"
 mail_platform_gateway_bind_port: "{{ mail_platform_gateway_port }}"
-mail_platform_gateway_force_brevo_fallback: true
-mail_platform_gateway_attempt_local_first: false
+mail_platform_gateway_force_brevo_fallback: false
+mail_platform_gateway_attempt_local_first: true
+mail_platform_dkim_enabled: true
+mail_platform_dkim_selector: mail
+mail_platform_dkim_private_key_local_file: "{{ repo_shared_local_root }}/mail-platform/dkim-private.pem"
+mail_platform_dkim_private_key_host_path: "{{ mail_platform_stalwart_dir }}/etc/dkim-private.pem"
+mail_platform_dkim_private_key_container_path: /opt/stalwart/etc/dkim-private.pem
+# Public key (base64, no PEM headers) — read from .local at runtime.
+# lookup() returns '' when the file is absent so a missing key becomes a visible empty record.
+mail_platform_dkim_public_key: >-
+  {{ lookup('ansible.builtin.file', repo_shared_local_root ~ '/mail-platform/dkim-public-key.txt', errors='ignore') | default('', true) | trim }}
+# DNS TXT record value split into ≤255-char chunks (DNS limit per string).
+# Produces: "v=DKIM1; k=rsa; p=<chunk1>" "<chunk2>"
+mail_platform_dkim_dns_value: >-
+  {%- set full = 'v=DKIM1; k=rsa; p=' ~ mail_platform_dkim_public_key -%}
+  "{{ full[:255] }}" "{{ full[255:] }}"
 mail_platform_gateway_uvicorn_workers: 1
 mail_platform_gateway_api_user: mail-platform
 mail_platform_notification_profiles:

collections/ansible_collections/lv3/platform/roles/mail_platform_runtime/files/mail-gateway/app.py

@@ -73,6 +73,7 @@ def load_notification_profiles() -> dict[str, dict[str, Any]]:
         api_key = str(item.get("gateway_api_key", "")).strip()
         mailbox_address = str(item.get("mailbox_address", "")).strip()
         mailbox_localpart = str(item.get("mailbox_localpart", "")).strip()
+        mailbox_password = str(item.get("mailbox_password", "")).strip()
         description = str(item.get("description", "")).strip()
         owner = str(item.get("owner", "")).strip()
         credential_scope = str(item.get("credential_scope", "")).strip()
@@ -106,6 +107,7 @@ def load_notification_profiles() -> dict[str, dict[str, Any]]:
             "id": profile_id,
             "mailbox_localpart": mailbox_localpart,
             "mailbox_address": mailbox_address,
+            "mailbox_password": mailbox_password,
             "sender_email": sender_email,
             "sender_name": sender_name,
             "reply_to": reply_to,
@@ -373,10 +375,14 @@ def send_via_local_smtp(payload: SendRequest, profile: dict[str, Any]) -> None:
         message.set_content(payload.text or "")
 
     context = ssl.create_default_context()
+    context.check_hostname = False
+    context.verify_mode = ssl.CERT_NONE  # local Stalwart uses self-signed cert
     with smtplib.SMTP(LOCAL_SMTP_HOST, LOCAL_SMTP_PORT, timeout=20) as client:
         client.starttls(context=context)
-        if LOCAL_SMTP_USERNAME and LOCAL_SMTP_PASSWORD:
-            client.login(LOCAL_SMTP_USERNAME, LOCAL_SMTP_PASSWORD)
+        smtp_username = profile.get("mailbox_localpart") or LOCAL_SMTP_USERNAME
+        smtp_password = profile.get("mailbox_password") or LOCAL_SMTP_PASSWORD
+        if smtp_username and smtp_password:
+            client.login(smtp_username, smtp_password)
         client.send_message(message)
 
 

collections/ansible_collections/lv3/platform/roles/mail_platform_runtime/tasks/main.yml

@@ -383,6 +383,16 @@
   become: false
   no_log: true
 
+- name: Deploy the DKIM private key for Stalwart outbound signing
+  ansible.builtin.copy:
+    src: "{{ mail_platform_dkim_private_key_local_file }}"
+    dest: "{{ mail_platform_dkim_private_key_host_path }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: mail_platform_dkim_enabled | default(false)
+  no_log: true
+
 - name: Render the Stalwart configuration file
   ansible.builtin.template:
     src: stalwart-config.toml.j2

collections/ansible_collections/lv3/platform/roles/mail_platform_runtime/templates/stalwart-config.toml.j2

@@ -80,3 +80,17 @@ events = {{ mail_platform_webhook_events | to_json }}
 timeout = "10s"
 throttle = "1s"
 lossy = false
+{% if mail_platform_dkim_enabled | default(false) %}
+
+[signature."rsa-{{ mail_platform_dkim_selector }}"]
+private-key = "file://{{ mail_platform_dkim_private_key_container_path }}"
+algorithm = "rsa-sha256"
+domain = "{{ mail_platform_domain }}"
+selector = "{{ mail_platform_dkim_selector }}"
+headers.sign = ["From", "To", "Date", "Message-ID", "Subject", "MIME-Version", "Content-Type"]
+headers.oversign = ["From"]
+expiration = "7d"
+
+[queue.outbound.signing]
+sign = [{ else = ["rsa-{{ mail_platform_dkim_selector }}"] }]
+{% endif %}

inventory/host_vars/proxmox-host.yml

@@ -1973,28 +1973,39 @@ mail_platform_dns_records:
     ttl: 300
   - name: "@"
     type: TXT
-    value: '"v=spf1 mx include:spf.brevo.com -all"'
+    value: '"v=spf1 mx ~all"'
     value_match_regex: '^"v=spf1 '
     ttl: 300
   - name: _dmarc
     type: TXT
     value: "\"v=DMARC1; p=quarantine; rua=mailto:{{ platform_operator_email }}\""
     ttl: 300
+  - name: "mail._domainkey"
+    type: TXT
+    # DKIM key exceeds 255 chars per DNS string; split into two quoted chunks.
+    # mail_platform_dkim_dns_value is computed in role defaults from dkim-public-key.txt.
+    value: "{{ mail_platform_dkim_dns_value }}"
+    value_match_regex: '^"v=DKIM1; k=rsa; p='
+    ttl: 300
+  # Retire Brevo-specific records — mail is now delivered via local Stalwart SMTP
   - name: brevo1._domainkey
     type: CNAME
     value: b1.lv3-org.dkim.brevo.com.
     value_match_regex: '^b1\\.lv3-org\\.dkim\\.brevo\\.com\\.?$'
     ttl: 300
+    state: absent
   - name: brevo2._domainkey
     type: CNAME
     value: b2.lv3-org.dkim.brevo.com.
     value_match_regex: '^b2\\.lv3-org\\.dkim\\.brevo\\.com\\.?$'
     ttl: 300
+    state: absent
   - name: "@"
     type: TXT
     value: '"brevo-code:b5e6a2e60000b8da96b912f8ea4c2e9a"'
     value_match_regex: '^"brevo-code:'
     ttl: 300
+    state: absent
 
 route_dns_assertion_extra_records:
   - name: "@"