MI-483 - Staging configuration, service files and setup script #1

transilvlad · 2025-10-22T20:43:03Z

This is the first commit that implements deployable scripts in our internal robin fork.

I configured the RAW web hook to post to Postal instance in staging
- This needs templating in cfg-prod/webhooks.json5
Also configured Dovecot LDA binary and AUTH socket to validate and authenticate users and deliver to their mailbox in cfg-prod/dovecot.json5
Logs rotate automagically daily and will be in /var/log/robin-20281020.log (see cfg-prod/log4j2.xml)
We can push metrics to Betterstack by configuring the endpoint in cfg-prod/prometheus.json5
Relaying both inbound and outbound are enabled in cfg-prod/relay.json5
Ports and threads and more are configured in cfg-prod/server.json5
It's temporary storage and dovecot storage/LDA is enabled in cfg-prod/storage.json5
Queue and it's DB location and email storage folder are configured in cfg-prod/queue.json5

Note:

We need to install JDK 21 or 17 from Amazon Coretto to run it and latest Maven to compile it.
It needs to run on the same host as Dovecot to use Dovecot-LDA binary.
It has endpoints on ports 8080 for metrics and 8090 for client API and queueing and queue listing

Improvements:

Queue could use a SQL integration
LMTP proxy could be used instead of the socket and binary allowing containerisation (to be developed).

notion-workspace · 2025-10-22T20:43:08Z

[Robin] Add required features to integrate with Dovecot and Postal replacing Postfix & relay.py

Copilot

Pull Request Overview

This PR implements staging deployment configuration for the Robin MTA service, enabling it to be deployed and managed on production infrastructure. The changes include configuration files for webhook integration with Postal, Dovecot integration for mail delivery, logging rotation, metrics collection, and systemd service management.

Key Changes:

Added deployment scripts (setup.sh, robin.sh, robin.service) for automated installation and service lifecycle management
Configured production settings for SMTP server, storage, relaying, queueing, and monitoring in cfg-prod/ directory
Integrated Dovecot LDA for local mail delivery and authentication

Reviewed Changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
setup.sh	Automated setup script that builds the project, deploys binaries and configuration files, and installs systemd service
robin.sh	Service control script for managing Robin MTA lifecycle (start, stop, restart, status, tail)
robin.service	Systemd unit file for running Robin as a managed service
cfg-prod/webhooks.json5	Webhook configurations for SMTP extensions with Postal integration endpoint
cfg-prod/dovecot.json5	Dovecot authentication socket and LDA binary paths for local mail delivery
cfg-prod/server.json5	SMTP server configuration including ports, TLS, thread pools, and metrics endpoints
cfg-prod/storage.json5	Email storage configuration with Dovecot LDA integration enabled
cfg-prod/relay.json5	Inbound/outbound relay configuration with MX lookup and LMTP protocol settings
cfg-prod/queue.json5	Queue persistence and processing interval settings
cfg-prod/log4j2.xml	Log4j2 configuration with daily log rotation
cfg-prod/prometheus.json5	Prometheus metrics push configuration template
cfg-prod/properties.json5	General properties including logging levels and HTTP timeouts
cfg-prod/routes.json5	Predefined delivery routes for localhost and staging environments
cfg-prod/scenarios.json5	SMTP response scenarios for testing and custom behaviors
cfg-prod/client.json5	Default SMTP client configuration with TLS settings
cfg-prod/users.json5	Empty users array (authentication disabled)

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-22T20:44:07Z

setup.sh

+# Copy keystore
+cp src/test/resources/keystore.jks /usr/local/robin/keystore.jks


Copying a test keystore to production is a security risk. Production environments should use properly generated certificates and keystores, not test resources. Consider generating a production keystore or documenting that this must be replaced before production use.

Suggested change

# Copy keystore

cp src/test/resources/keystore.jks /usr/local/robin/keystore.jks

# DO NOT copy test keystore to production. Please generate or provide a secure production keystore.

echo "[WARN] No production keystore deployed. Please generate a secure keystore and place it at /usr/local/robin/keystore.jks before starting the service." >&2

Copilot · 2025-10-22T20:44:07Z

cfg-prod/server.json5

+  keystorepassword: "avengers",
+
+  // Java truststore (default: /usr/local/truststore.jks).
+  truststore: "/usr/local/robin/truststore.jks",
+
+  // Truststore password or path to password file.
+  truststorepassword: "avengers",


Hardcoded password 'avengers' in production configuration is a security vulnerability. Passwords should be stored in secure vaults or environment variables, not committed to version control.

Suggested change

keystorepassword: "avengers",

// Java truststore (default: /usr/local/truststore.jks).

truststore: "/usr/local/robin/truststore.jks",

// Truststore password or path to password file.

truststorepassword: "avengers",

keystorepassword: "/run/secrets/keystorepassword",

// Java truststore (default: /usr/local/truststore.jks).

truststore: "/usr/local/robin/truststore.jks",

// Truststore password or path to password file.

truststorepassword: "/run/secrets/truststorepassword",

Copilot · 2025-10-22T20:44:08Z

cfg-prod/server.json5

+  truststore: "/usr/local/robin/truststore.jks",
+
+  // Truststore password or path to password file.
+  truststorepassword: "avengers",


Hardcoded password 'avengers' in production configuration is a security vulnerability. Passwords should be stored in secure vaults or environment variables, not committed to version control.

Suggested change

truststorepassword: "avengers",

truststorepassword: "/run/secrets/truststorepassword",

Copilot · 2025-10-22T20:44:08Z

cfg-prod/properties.json5

+  // Path to MTA logs if one running on local host.
+  localLogsDir: "/var/log/",
+
+  // Pattern to match UID out of SMT responses.


Corrected spelling of 'SMT' to 'SMTP' in comment.

Suggested change

// Pattern to match UID out of SMT responses.

// Pattern to match UID out of SMTP responses.

Copilot · 2025-10-22T20:44:08Z

cfg-prod/log4j2.xml

+<?xml version="1.0" encoding="UTF-8"?>
+<Configuration monitorInterval="30" shutdownHook="disable">
+    <Appenders>
+        <RollingFile name="appender" filePattern="/var/log/robin-%d{yyyyMMdd}.log">


The RollingFile appender is missing the required 'fileName' attribute which specifies the current log file. Without it, the appender may not function correctly. Add 'fileName="/var/log/robin.log"' to the RollingFile element.

Suggested change

<RollingFile name="appender" filePattern="/var/log/robin-%d{yyyyMMdd}.log">

<RollingFile name="appender" fileName="/var/log/robin.log" filePattern="/var/log/robin-%d{yyyyMMdd}.log">

Copilot · 2025-10-22T20:44:08Z

cfg-prod/properties.json5

+
+  // Humio configuration.
+  humio: {
+    auth: "YOUR_API_KEY",


Placeholder API key should be removed or documented as requiring configuration. Committing placeholder credentials can lead to misconfigurations in production deployments.

Suggested change

auth: "YOUR_API_KEY",

// WARNING: Set a valid Humio API key here before deploying to production. Do NOT commit real credentials.

auth: "__REQUIRED__",

transilvlad added 2 commits October 22, 2025 22:23

MI-483 - Staging configuration, service files and setup script

2ede011

MI-483 - Use cfg-prod/ instead of cfg/

2c27e7c

transilvlad requested review from Copilot, looped0 and webcat12345 October 22, 2025 20:43

transilvlad self-assigned this Oct 22, 2025

Copilot AI reviewed Oct 22, 2025

View reviewed changes

transilvlad added 3 commits October 22, 2025 23:58

Merge branch 'master' into MI-483-staging

f8d416b

MI-483 - Update from upstream

97e7cdc

Merge branch 'master' into MI-483-staging

c3a0b09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

MI-483 - Staging configuration, service files and setup script #1

MI-483 - Staging configuration, service files and setup script #1

Uh oh!

transilvlad commented Oct 22, 2025

Uh oh!

notion-workspace bot commented Oct 22, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		# Copy keystore
		cp src/test/resources/keystore.jks /usr/local/robin/keystore.jks

	truststorepassword: "avengers",
	truststorepassword: "/run/secrets/truststorepassword",

	// Pattern to match UID out of SMT responses.
	// Pattern to match UID out of SMTP responses.

	<RollingFile name="appender" filePattern="/var/log/robin-%d{yyyyMMdd}.log">
	<RollingFile name="appender" fileName="/var/log/robin.log" filePattern="/var/log/robin-%d{yyyyMMdd}.log">

	auth: "YOUR_API_KEY",
	// WARNING: Set a valid Humio API key here before deploying to production. Do NOT commit real credentials.
	auth: "__REQUIRED__",

Uh oh!

MI-483 - Staging configuration, service files and setup script #1

Are you sure you want to change the base?

MI-483 - Staging configuration, service files and setup script #1

Uh oh!

Conversation

transilvlad commented Oct 22, 2025

Uh oh!

notion-workspace bot commented Oct 22, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants