docs(openclaw-mail): codify gateway runtime route #393

Merged

pdurlej merged 1 commit from codex/openclaw-mail-gateway-runtime-docs into main

2026-05-19 11:29:33 +02:00

codex commented

2026-05-19 11:27:09 +02:00

Collaborator

Canary status: missing — runtime route codification; rely on required Forgejo checks before merge

Canary Context Pack

Product story

OpenClaw mail gateway is now live on VPS1000 and publicly reachable through RS2000 Traefik. The platform repo should reflect that runtime so future agents do not read stale rs2000/docker-compose metadata or lose the route on a later release-root sync.

What changed

Updated modules/openclaw-mail-gateway/module.yaml from stale rs2000/docker-compose/inbound metadata to the live VPS1000 systemd-user runtime.
Updated modules/openclaw-mail-gateway/runbook.md with the actual unit, Tailnet bind, public URL, health checks, restart procedure, and known scope boundary.
Added config/traefik/dynamic/openclaw-mail-gateway.yml, matching the live RS2000 Traefik file-provider route to http://100.79.239.52:8086.

Why it changed

The service was deployed and smoked successfully, but runtime truth still lived only as manual server state. This PR closes that drift.

Files touched

config/traefik/dynamic/openclaw-mail-gateway.yml
modules/openclaw-mail-gateway/module.yaml
modules/openclaw-mail-gateway/runbook.md

Relevant context

Live VPS1000 unit: openclaw-mail-gateway.service
Live RS2000 file-provider route: /opt/vps-home-platform-infra/config/traefik/dynamic/openclaw-mail-gateway.yml
Public URL: https://mail-gateway.pdurlej.com
Iskra/OpenClaw coordination issue: pdurlej/iskra-openclaw#332

Runtime evidence

VPS1000 tests before deploy: uv sync --extra dev && uv run pytest -> 36 passed in 1.57s.
RS2000 Tailnet backend health: curl http://100.79.239.52:8086/health -> status=ok, provider=resend, allowlist_size=3.
Public health: curl https://mail-gateway.pdurlej.com/health -> HTTP 200, valid Let's Encrypt cert CN=mail-gateway.pdurlej.com.
Public Missive smoke: POST https://mail-gateway.pdurlej.com/v1/missive/posts -> HTTP 200, audit post_id_matches=true.

Known constraints

This PR codifies existing live runtime. It does not install the VPS1000 unit or deploy the service; that is already done.
exposure.auth remains none because the current schema models edge auth only; the live API endpoint is application bearer-protected.
The Missive webhook receiver is explicitly out of scope.

Explicit out-of-scope

Generating VPS1000 systemd units from platformctl.
Moving the SQLite audit DB.
Missive inbound webhook receiver sprint.
OpenClaw MCP Z2/Z3 wiring.

Requested decision

Merge to record the live gateway route and runtime metadata in platform desired state.

Merge blockers

Any mismatch between the dynamic route and live RS2000 file-provider route.
Any claim that this PR deploys runtime code or changes secrets.

Spec sources read

modules/openclaw-mail-gateway/module.yaml — stale manifest being corrected.
modules/openclaw-mail-gateway/runbook.md — stale recovery docs being corrected.
modules/traefik/module.yaml — confirms config/traefik/dynamic/ is owned platform metadata.
compose/edge/compose.yaml — confirms Traefik file-provider mount path.
schema/module.schema.json — confirms valid systemd-user runtime fields.

Verification

python3 YAML parse for module and Traefik dynamic file: OK.
PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/openclaw-mail-gateway/module.yaml: OK.
PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_validate.py: 6 passed.
curl -fsS https://mail-gateway.pdurlej.com/health: OK.

Closes no issue.

Canary status: missing — runtime route codification; rely on required Forgejo checks before merge ## Canary Context Pack ### Product story OpenClaw mail gateway is now live on VPS1000 and publicly reachable through RS2000 Traefik. The platform repo should reflect that runtime so future agents do not read stale rs2000/docker-compose metadata or lose the route on a later release-root sync. ### What changed - Updated `modules/openclaw-mail-gateway/module.yaml` from stale rs2000/docker-compose/inbound metadata to the live VPS1000 systemd-user runtime. - Updated `modules/openclaw-mail-gateway/runbook.md` with the actual unit, Tailnet bind, public URL, health checks, restart procedure, and known scope boundary. - Added `config/traefik/dynamic/openclaw-mail-gateway.yml`, matching the live RS2000 Traefik file-provider route to `http://100.79.239.52:8086`. ### Why it changed The service was deployed and smoked successfully, but runtime truth still lived only as manual server state. This PR closes that drift. ### Files touched - `config/traefik/dynamic/openclaw-mail-gateway.yml` - `modules/openclaw-mail-gateway/module.yaml` - `modules/openclaw-mail-gateway/runbook.md` ### Relevant context - Live VPS1000 unit: `openclaw-mail-gateway.service` - Live RS2000 file-provider route: `/opt/vps-home-platform-infra/config/traefik/dynamic/openclaw-mail-gateway.yml` - Public URL: `https://mail-gateway.pdurlej.com` - Iskra/OpenClaw coordination issue: `pdurlej/iskra-openclaw#332` ### Runtime evidence - VPS1000 tests before deploy: `uv sync --extra dev && uv run pytest` -> `36 passed in 1.57s`. - RS2000 Tailnet backend health: `curl http://100.79.239.52:8086/health` -> `status=ok`, `provider=resend`, `allowlist_size=3`. - Public health: `curl https://mail-gateway.pdurlej.com/health` -> HTTP 200, valid Let's Encrypt cert `CN=mail-gateway.pdurlej.com`. - Public Missive smoke: `POST https://mail-gateway.pdurlej.com/v1/missive/posts` -> HTTP 200, audit `post_id_matches=true`. ### Known constraints - This PR codifies existing live runtime. It does not install the VPS1000 unit or deploy the service; that is already done. - `exposure.auth` remains `none` because the current schema models edge auth only; the live API endpoint is application bearer-protected. - The Missive webhook receiver is explicitly out of scope. ### Explicit out-of-scope - Generating VPS1000 systemd units from `platformctl`. - Moving the SQLite audit DB. - Missive inbound webhook receiver sprint. - OpenClaw MCP Z2/Z3 wiring. ### Requested decision Merge to record the live gateway route and runtime metadata in platform desired state. ### Merge blockers - Any mismatch between the dynamic route and live RS2000 file-provider route. - Any claim that this PR deploys runtime code or changes secrets. ## Spec sources read - `modules/openclaw-mail-gateway/module.yaml` — stale manifest being corrected. - `modules/openclaw-mail-gateway/runbook.md` — stale recovery docs being corrected. - `modules/traefik/module.yaml` — confirms `config/traefik/dynamic/` is owned platform metadata. - `compose/edge/compose.yaml` — confirms Traefik file-provider mount path. - `schema/module.schema.json` — confirms valid `systemd-user` runtime fields. ## Verification - `python3` YAML parse for module and Traefik dynamic file: OK. - `PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/openclaw-mail-gateway/module.yaml`: OK. - `PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_validate.py`: 6 passed. - `curl -fsS https://mail-gateway.pdurlej.com/health`: OK. Closes no issue.

codex added 1 commit

2026-05-19 11:27:09 +02:00

docs(openclaw-mail): codify gateway runtime route

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 18s

Details

canary-required / canary (pull_request) Successful in 12s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 20s