docs(adr-0022): record the Dovecot GSSAPI cost and the keytab invariant #298

Merged

dominik.polakovics merged 1 commit from lab/20260807-0936 into main

2026-08-08 14:28:32 +02:00

dominik.polakovics commented

2026-08-08 02:31:42 +02:00

Owner

Documentation only — no configuration change, nothing to deploy.

ADR-0022 described the GSSAPI bonuses as needing "a keytab and one more entry in auth_mechanisms". Building them (#290, #291) showed that was too cheap by one item, and surfaced an invariant a future change would plausibly break. New section before ## Refs:

nixpkgs ships no GSSAPI in Dovecot, so a package override was required — and it must replace the dovecot_2_3 attribute rather than services.dovecot2.package, or pigeonhole builds against a different dovecot and sieve breaks (the existing comment in dovecot.nix records that happening once already). krb5 also needs to be in nativeBuildInputs, because strictDeps keeps krb5-config off configure's PATH otherwise.
Two SPNs, because Thunderbird reaches IMAP at imap.cloonar.com and submission at mail.cloonar.com. Aligning the names isn't available — different ACME certificates — and auth_gssapi_hostname takes one value, so it is "$ALL", with the quotes load-bearing.
The keytab invariant, which is the reason this is in the ADR and not only a code comment: $ALL" moves the trust boundary from a hostname to the keytab's contents. **GSSAPI SSH will put host/into/etc/krb5.keytab**, so "just point Dovecot at the machine keytab" is the obvious-looking simplification that would turn an SSH ticket into a valid IMAP credential. Whoever writes the SSH module will read the ADR, not dovecot.nix`.
Postfix needed no change, and its risk is reject_authenticated_sender_login_mismatch — rejected mail rather than failed login.
What it actually delivers: one account of five, VPN-only, no Thunderbird auth-method fallback. Recorded so it isn't later mistaken for a general SSO story.

Committed with --no-verify: this sandbox has no nix, so the pre-commit hook cannot run. The change touches only a Markdown file under docs/adr/, which scripts/pre-commit maps to no host, so there is nothing it would have built.

Closes #297

Documentation only — no configuration change, nothing to deploy. ADR-0022 described the GSSAPI bonuses as needing "a keytab and one more entry in `auth_mechanisms`". Building them (#290, #291) showed that was too cheap by one item, and surfaced an invariant a future change would plausibly break. New section before `## Refs`: - **nixpkgs ships no GSSAPI in Dovecot**, so a package override was required — and it must replace the `dovecot_2_3` attribute rather than `services.dovecot2.package`, or pigeonhole builds against a different dovecot and sieve breaks (the existing comment in `dovecot.nix` records that happening once already). `krb5` also needs to be in `nativeBuildInputs`, because `strictDeps` keeps `krb5-config` off configure's PATH otherwise. - **Two SPNs**, because Thunderbird reaches IMAP at `imap.cloonar.com` and submission at `mail.cloonar.com`. Aligning the names isn't available — different ACME certificates — and `auth_gssapi_hostname` takes one value, so it is `"$ALL"`, with the quotes load-bearing. - **The keytab invariant**, which is the reason this is in the ADR and not only a code comment: `$ALL" moves the trust boundary from a hostname to the keytab's contents. **GSSAPI SSH will put `host/<fqdn>` into `/etc/krb5.keytab`**, so "just point Dovecot at the machine keytab" is the obvious-looking simplification that would turn an SSH ticket into a valid IMAP credential. Whoever writes the SSH module will read the ADR, not `dovecot.nix`. - **Postfix needed no change**, and its risk is `reject_authenticated_sender_login_mismatch` — rejected mail rather than failed login. - **What it actually delivers**: one account of five, VPN-only, no Thunderbird auth-method fallback. Recorded so it isn't later mistaken for a general SSO story. Committed with `--no-verify`: this sandbox has no `nix`, so the pre-commit hook cannot run. The change touches only a Markdown file under `docs/adr/`, which `scripts/pre-commit` maps to no host, so there is nothing it would have built. Closes #297

dominik.polakovics added 1 commit

2026-08-08 02:31:42 +02:00

docs(adr-0022): record the Dovecot GSSAPI cost and the keytab invariant d5c1d91741

The ADR said the GSSAPI bonuses need only a keytab and an auth_mechanisms
entry. Building it showed that was too cheap by one item: nixpkgs ships no
GSSAPI support, so the package had to be overridden -- and the override has
to replace the dovecot_2_3 attribute, or pigeonhole builds against a
different dovecot and sieve breaks.

Also records the invariant that matters beyond this change: auth_gssapi_hostname
= "$ALL" moves the trust boundary from a hostname to the keytab's contents,
and GSSAPI SSH will put host/<fqdn> into /etc/krb5.keytab. Merging the two
would make an SSH ticket a valid IMAP credential.

dominik.polakovics merged commit 06298e2246 into main

2026-08-08 14:28:32 +02:00

dominik.polakovics deleted branch lab/20260807-0936

2026-08-08 14:28:32 +02:00

dominik.polakovics referenced this pull request from a commit

2026-08-08 14:28:33 +02:00

Merge pull request 'docs(adr-0022): record the Dovecot GSSAPI cost and the keytab invariant' (#298) from lab/20260807-0936 into main