Developer Only Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

@sourcemage.org developer email service has been migrated to the new
datacenter.  The setup is not the same as it used to be, so PLEASE READ
THE REST OF THIS AND DO WHAT IT ASKS so that you can receive your mail.

First, I apologize this transition is abrupt. I didn't intend that, but
fawkes froze up again while I was trying to do work on it, and since
this is the last thing that needed moving off that old host, I just
finished it.  Since it's mail, anything that was going to deliver would
have, and anything trying since then would be queuing for retry, so
nothing should be lost.

Regardless, as everyone is aware I think, mail hasn't been delivering
well from there for some time because it was just set up as a forwarding
server and forwarding destinations like gmail don't have a way to say
"accept all mail from this forwarder location" and instead flag it (and
us) as spammers and stop taking our mail anyway.

This is why the new system is different, and is not based on forwarding.
It is instead pop3.



Action 1) YOU WILL NEED TO CONFIGURE A POP3 CLIENT TO GET YOUR MAIL FROM
US.



When picking a pop3 client, please also be aware the only authentication
method we're supporting for right now is TLS client certificates. 



Action 2) YOU WILL NEED TO SEND US A CSR AND GET A CERT BACK TO GIVE
YOUR CLIENT. Please generate a CSR that has *your git login name* as the
CN and send it to me in a signed email. You can create this easily via:

$ openssl genrsa -out <your_id>.key 2048
$ openssl req -new -key <your_id>.key -out <your_id>.csr



For a pop3 client that just pulls your mail into your existing mail
spool, I recommend something like mpop(1), which is in the grimoire (but
needs updating) and does fine with TLS client certificates. A working
config is below.

If you are using a third party mail provider or a GUI that hides your
spool from you, hopefully they have direct support for client
certificates. If you get in a major bind with these requirements, let me
know what your setup is and we'll see what makes sense.

Unfortunately continuing to forward, especially into services like
gmail, cannot be supported without us taking on the burden of
pre-filtering on this end, and that's not something we are in any
position to do.

Please do try to get us a CSR as soon as possible, and configure a
client to pull your mail as soon as you get a cert back. We don't have
quotas configured on the spools at this time, but I expect to add those
at some point, and if we start having to store a ton of spam for people
I will add them sooner rather than later.

Currently the pop server is using a self-signed cert. I plan to get this
fixed, but wanted to get this email out ASAP. Changing the server cert
won't impact the client certificates, so please get on that regardless.



$ cat ~/.mpoprc

defaults
tls on
delivery maildir ~/Maildir
account sourcemage
host hedwig.sourcemage.org
tls_fingerprint 
15:E0:89:ED:DF:DA:27:A2:E6:17:D7:85:FC:FD:89:28:72:4E:02:81:30:AB:FB:15:D5:85:3D:9B:67:81:03:DA
auth plain
user jblosser
# password must be set but isn't used
password foobar
tls_key_file ~/.mpop/jblosser.key
tls_cert_file ~/.mpop/jblosser.crt
account default : sourcemage