6 Commits

Include renames

Author	SHA1	Message	Date
lyrathorpeandEmma Thorpe	f1e1373fd3	feat: add Python packaging metadata and a Nix flake (#16) ... ## What - `pyproject.toml` — setuptools metadata with a `legacy-email-proxy` console script. Runtime dependencies are read dynamically from `requirements.txt`, so the Docker build and the package cannot drift apart. - `proxy_server.run()` — a synchronous entry point for that console script; `main` is a coroutine and cannot be referenced by one. The `__main__` path behaves as before. - `flake.nix` / `package.nix` — the package, `overlays.default`, a dev shell, and `checks`. The pytest suite runs as part of the build. - `module.nix` — a NixOS module: `services.legacy-email-proxy` with freeform `settings` (environment variables) and a separate `environmentFile` for credentials, so secrets stay out of the Nix store. Runs under `DynamicUser`, takes `CAP_NET_BIND_SERVICE` only while a listener is on a privileged port, and opens no firewall ports. - README: pip install, Nix usage, and a NixOS service example. ## Why The proxy could only be consumed as a container. Anyone deploying it on NixOS had to vendor a package definition into their own configuration — which is exactly what happened downstream, and is now deleted there in favour of this. ## Not in scope - The `Dockerfile` and its CI workflow are untouched. - No Nix job in CI; the runner has no Nix. The build is reproducible locally with `nix flake check`. - `version` is static and tracks the latest tag (`0.3.0`); bump it with the tag. ## Verification - `nix flake check` — package builds, 14 tests pass inside the build. - Consumed from a downstream NixOS host with `--override-input`: the unit's `ExecStart` resolves to the module's own build, and that flake's checks pass too. --------- Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com> Reviewed-on: #16	2026-08-21 13:26:51 +01:00
lyrathorpe	4bde4f884d	feat: respect BACKEND_MUTATE to avoid mutating backend mailboxes by default; add tests and docs	2026-06-17 18:43:22 +01:00
lyrathorpe	e51740b8db	Document unauthenticated listener exposure (#13) ... Adds a Security section: the front-end POP3/SMTP listeners are unauthenticated and must be bound to a trusted internal network only. Closes #9 Reviewed-on: #13 Co-authored-by: Lyra Thorpe <iam@emmathe.dev> Co-committed-by: Lyra Thorpe <iam@emmathe.dev>	2026-06-17 17:33:51 +01:00
lyrathorpe	e05f08995e	chore: separate runtime and dev dependencies, add pytest config and CI cache	2026-06-17 16:40:39 +01:00
lyrathorpe	aa746b780d	test: add pytest coverage and run tests in CI	2026-06-17 16:14:22 +01:00
lyrathorpe	e6eca290ba	chore: add documented POP3/SMTP proxy scaffold and Renovate config	2026-06-17 16:08:06 +01:00