Skip to content

Harden encrypted mail storage, recovery, and forwarding - #8

Merged
chrisbbreuer merged 7 commits into
mainfrom
codex/mail-storage-hardening
Jul 29, 2026
Merged

Harden encrypted mail storage, recovery, and forwarding#8
chrisbbreuer merged 7 commits into
mainfrom
codex/mail-storage-hardening

Conversation

@chrisbbreuer

@chrisbbreuer chrisbbreuer commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • encrypt all persisted mail state in LUKS2 on a dedicated Hetzner volume, with external AWS KMS/Secrets Manager key custody and an independent Keychain recovery slot
  • add verified local and Restic backups, restores, health monitoring, header escrow, and reusable recovery/migration commands
  • adopt canonical Maildir++ folders and deterministic RFC 5228 Sieve forwarding
  • track current Zig 0.17-dev and pin TLS to the canonical zig-utils/zig-tls compatibility revision instead of a divergent vendored snapshot

Production validation

  • rebooted into the expected locked state, then unlocked through AWS; mail is active
  • recovery key verified against the live LUKS header
  • customer-KMS encryption verified on secrets, buckets, and the latest header backup
  • latest Restic backup and full restore check passed (725 messages; SQLite quick_check passed)
  • 31 mailboxes / 67 folders migrated to Maildir++; ownership and permissions verified
  • live hi@ and socials@ forwarding probes passed and probe messages were removed
  • SMTP/SMTPS/submission/IMAP/IMAPS ports verified after reboot

Local validation

  • exact official Zig 0.17.0-dev.1476+91a29d707
  • zig fmt --check src/
  • zig build test
  • zig build -Doptimize=ReleaseFast
  • shell syntax checks and git diff --check

Companion TLS fix: zig-utils/zig-tls#8

Closes #4
Closes #5
Closes #6
Closes #7

@chrisbbreuer
fix(zig): restore pinned Zig 0.16 build compatibility
90193a8 
Pin zig-cli before its Zig 0.17 migration and update application and vendored code for the current unmanaged collections, enum, build, and TLS APIs.

Refs #7
@chrisbbreuer
feat(storage): harden encrypted mail data and recovery
2fee633 
Add LUKS2 lifecycle helpers, dedicated-volume migration, KMS-backed object storage, verified local and Restic backups, recovery checks, and health timers.

Refs #4
@chrisbbreuer
feat(mail): adopt Sieve forwarding and Maildir++ layout
9f7fb90 
Compile deterministic RFC 5228 forwarding rules, load them during delivery, and migrate IMAP folders to canonical Maildir++ while retaining compatibility links.

Refs #5

Refs #6
This was referenced Jul 29, 2026
Merged
Closed
Closed
Closed
Closed
Closed
@chrisbbreuer
ci(zig): track latest Zig 0.17-dev toolchain
76fe1b8 
Pin all workflows to the current official master build, 0.17.0-dev.1476+91a29d707.

Refs #7
@chrisbbreuer
Revert "fix(zig): restore pinned Zig 0.16 build compatibility"
87124b9 
This reverts commit 90193a8.
@chrisbbreuer
fix(zig): use canonical TLS on latest Zig 0.17-dev
7951d48 
Pin zig-utils/zig-tls at its current Zig master compatibility revision, remove the divergent vendored snapshot, and apply the remaining 0.17 formatter and ArrayList updates.

Refs #7
@chrisbbreuer
chore(tls): pin complete Zig 0.17 compatibility fix
ccb18cc 
Advance the canonical TLS revision to include the benchmark compatibility pass.

Refs #7
@chrisbbreuer
chrisbbreuer marked this pull request as ready for review July 29, 2026 06:28
@chrisbbreuer
chrisbbreuer merged commit 23e39e9 into main Jul 29, 2026
6 checks passed
@chrisbbreuer
chrisbbreuer deleted the codex/mail-storage-hardening branch July 29, 2026 06:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

1 participant

@chrisbbreuer