#18: implement SMTP Submission (587/465), SASL PLAIN/LOGIN auth and preflight diagnostics

services/protocols/cmd/lambdamail-protocols/preflight.go

@@ -0,0 +1,112 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"time"
+
+	"lambdamail/protocols/internal/application/usecase"
+	tlsprovider "lambdamail/protocols/internal/infrastructure/tls"
+)
+
+// runPreflight executes the environment checks of PLAN.md section 15 and
+// exits non-zero when a critical one fails, so the deploy pipeline can gate
+// on it.
+func runPreflight(cfg config) {
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	report := usecase.NewPreflightUseCase(buildPreflightDeps(cfg)).Execute(ctx, usecase.PreflightInput{
+		PrimaryMailHost: cfg.PrimaryMailHost,
+		MailDomain:      cfg.domain(),
+		PublicIPv4:      cfg.PublicIPv4,
+		PublicIPv6:      cfg.PublicIPv6,
+		DaneEnabled:     cfg.OutboundDane,
+		TLSMode:         cfg.TLSMode,
+		SmarthostSet:    cfg.RelayHost != "",
+	})
+
+	fmt.Print(report)
+
+	if report.Blocking() {
+		fmt.Fprintln(os.Stderr, "\npreflight FAILED: at least one critical check did not pass")
+		os.Exit(1)
+	}
+	fmt.Println("\npreflight passed")
+}
+
+func buildPreflightDeps(cfg config) usecase.PreflightDeps {
+	resolver := net.DefaultResolver
+
+	deps := usecase.PreflightDeps{
+		DialPort25: func(ctx context.Context, address string) error {
+			dialer := net.Dialer{Timeout: 10 * time.Second}
+			conn, err := dialer.DialContext(ctx, "tcp", address)
+			if err != nil {
+				return err
+			}
+			return conn.Close()
+		},
+		LookupAddr: resolver.LookupAddr,
+		LookupHost: resolver.LookupHost,
+		LookupTXT:  resolver.LookupTXT,
+		FetchMtaSts: func(ctx context.Context, domain string) error {
+			url := fmt.Sprintf("https://mta-sts.%s/.well-known/mta-sts.txt", domain)
+			req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+			if err != nil {
+				return err
+			}
+			// The certificate is validated on purpose: RFC 8461 section 3.3
+			// requires the policy to be served under a valid certificate for
+			// the mta-sts host, and a sender that cannot validate it ignores
+			// the policy entirely.
+			resp, err := (&http.Client{Timeout: 15 * time.Second}).Do(req)
+			if err != nil {
+				return err
+			}
+			defer resp.Body.Close()
+			if resp.StatusCode != http.StatusOK {
+				return fmt.Errorf("HTTP %d", resp.StatusCode)
+			}
+			return nil
+		},
+		FreeDiskPercent: func() (float64, error) { return freeDiskPercent(cfg.SpoolDir) },
+		Now:             time.Now,
+		NetworkTime:     httpDateTime,
+	}
+
+	// The certificate check only means something when a store is configured;
+	// otherwise it stays skipped rather than reporting a false pass.
+	if cfg.TraefikAcmeDir != "" {
+		if watcher, err := tlsprovider.NewAcmeCertWatcher(cfg.TraefikAcmeDir, cfg.TraefikAcmeFile, cfg.PrimaryMailHost); err == nil {
+			deps.HasCertificateFor = watcher.HasCertificateFor
+		}
+	}
+
+	return deps
+}
+
+// httpDateTime reads a trusted clock from the Date header of a well-known
+// HTTPS endpoint. It is not NTP, but it is accurate to about a second, which
+// is enough to catch the drift that breaks DKIM and TOTP.
+func httpDateTime(ctx context.Context) (time.Time, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodHead, "https://www.cloudflare.com/", nil)
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	resp, err := (&http.Client{Timeout: 10 * time.Second}).Do(req)
+	if err != nil {
+		return time.Time{}, err
+	}
+	defer resp.Body.Close()
+
+	dateHeader := resp.Header.Get("Date")
+	if dateHeader == "" {
+		return time.Time{}, fmt.Errorf("no Date header in the response")
+	}
+	return http.ParseTime(dateHeader)
+}