Announcing nauthilus-director: a Nauthilus-backed mail protocol director

--===============7647276582508150491==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_D9EB8C05-ADB8-4B0D-B1B1-5709225A234D"


--Apple-Mail=_D9EB8C05-ADB8-4B0D-B1B1-5709225A234D
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hi,

I would like to announce `nauthilus-director` for the first time on this =
list.

`nauthilus-director` is an open-source mail protocol director and =
transparent proxy for Nauthilus-backed mail deployments. It sits in =
front of stateful mail backends, authenticates frontend sessions through =
Nauthilus, resolves routing and placement inside the director, selects =
healthy backend services, keeps active user affinity in Redis, and then =
proxies the established connection to the selected backend.

The current focus is on deployments where backend placement, =
maintenance, drains, user movement and session affinity need to be =
explicit, observable and controllable. The director is not a mailbox =
server and not a general-purpose load balancer; it owns the narrow =
director responsibilities between clients, Nauthilus and backend mail =
services.

Current capabilities include:

- IMAP/IMAPS, POP3/POP3S, LMTP/LMTPS and ManageSieve proxying
- Nauthilus-backed authentication over HTTP or gRPC
- director-owned routing and backend selection
- Redis-backed session affinity and runtime coordination
- backend health, maintenance, runtime drains and placement overrides
- an OpenAPI-based REST control API and `nauthilus-directorctl`
- metrics, structured logging and OpenTelemetry tracing

The demo stack includes Dovecot backend shards and exercises real IMAP, =
LMTP, POP3 and ManageSieve paths, so feedback from Dovecot operators =
would be especially useful.

Related to this, Nauthilus itself has recently been released as version =
3.0.0. Nauthilus is the central authentication and policy engine in this =
setup: it provides centralized authentication and identity handling for =
mail and web workloads, LDAP-backed or Lua-driven policy decisions, =
OIDC/SAML IdP functionality, MFA support, and Redis-backed state =
handling. In the director architecture, Nauthilus remains the =
authentication and policy authority, while `nauthilus-director` owns =
concrete backend placement and proxy lifecycle decisions.

Project links:

- nauthilus-director: https://github.com/croessner/nauthilus-director
- Nauthilus: https://github.com/croessner/nauthilus
- Documentation / website: https://nauthilus.org

The director is still young, so I would be interested in feedback from =
people running Dovecot-backed infrastructures, especially around =
operational workflows, backend maintenance, migration scenarios and =
protocol behavior. The director is still in beta.

Best regards,

Christian R=C3=B6=C3=9Fner
--=20
R=C3=B6=C3=9Fner-Network-Solutions
Zertifizierter ITSiBe / CISO
Marburger Str. 70a, 36304 Alsfeld
Mobil: +49 171 9905345
USt-IdNr.: DE225643613, https://roessner.website
PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5=20


--Apple-Mail=_D9EB8C05-ADB8-4B0D-B1B1-5709225A234D
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"

ICAgSGksCiAgIEkgd291bGQgbGlrZSB0byBhbm5vdW5jZSBgbmF1dGhpbHVzLWRpcmVjdG9yYCBm
b3IgdGhlIGZpcnN0IHRpbWUgb24gdGhpcwogICBsaXN0LgogICBgbmF1dGhpbHVzLWRpcmVjdG9y
YCBpcyBhbiBvcGVuLXNvdXJjZSBtYWlsIHByb3RvY29sIGRpcmVjdG9yIGFuZAogICB0cmFuc3Bh
cmVudCBwcm94eSBmb3IgTmF1dGhpbHVzLWJhY2tlZCBtYWlsIGRlcGxveW1lbnRzLiBJdCBzaXRz
IGluIGZyb250CiAgIG9mIHN0YXRlZnVsIG1haWwgYmFja2VuZHMsIGF1dGhlbnRpY2F0ZXMgZnJv
bnRlbmQgc2Vzc2lvbnMgdGhyb3VnaAogICBOYXV0aGlsdXMsIHJlc29sdmVzIHJvdXRpbmcgYW5k
IHBsYWNlbWVudCBpbnNpZGUgdGhlIGRpcmVjdG9yLCBzZWxlY3RzCiAgIGhlYWx0aHkgYmFja2Vu
ZCBzZXJ2aWNlcywga2VlcHMgYWN0aXZlIHVzZXIgYWZmaW5pdHkgaW4gUmVkaXMsIGFuZCB0aGVu
CiAgIHByb3hpZXMgdGhlIGVzdGFibGlzaGVkIGNvbm5lY3Rpb24gdG8gdGhlIHNlbGVjdGVkIGJh
Y2tlbmQuCiAgIFRoZSBjdXJyZW50IGZvY3VzIGlzIG9uIGRlcGxveW1lbnRzIHdoZXJlIGJhY2tl
bmQgcGxhY2VtZW50LCBtYWludGVuYW5jZSwKICAgZHJhaW5zLCB1c2VyIG1vdmVtZW50IGFuZCBz
ZXNzaW9uIGFmZmluaXR5IG5lZWQgdG8gYmUgZXhwbGljaXQsIG9ic2VydmFibGUKICAgYW5kIGNv
bnRyb2xsYWJsZS4gVGhlIGRpcmVjdG9yIGlzIG5vdCBhIG1haWxib3ggc2VydmVyIGFuZCBub3Qg
YQogICBnZW5lcmFsLXB1cnBvc2UgbG9hZCBiYWxhbmNlcjsgaXQgb3ducyB0aGUgbmFycm93IGRp
cmVjdG9yCiAgIHJlc3BvbnNpYmlsaXRpZXMgYmV0d2VlbiBjbGllbnRzLCBOYXV0aGlsdXMgYW5k
IGJhY2tlbmQgbWFpbCBzZXJ2aWNlcy4KICAgQ3VycmVudCBjYXBhYmlsaXRpZXMgaW5jbHVkZToK
ICAgLSBJTUFQL0lNQVBTLCBQT1AzL1BPUDNTLCBMTVRQL0xNVFBTIGFuZCBNYW5hZ2VTaWV2ZSBw
cm94eWluZwogICAtIE5hdXRoaWx1cy1iYWNrZWQgYXV0aGVudGljYXRpb24gb3ZlciBIVFRQIG9y
IGdSUEMKICAgLSBkaXJlY3Rvci1vd25lZCByb3V0aW5nIGFuZCBiYWNrZW5kIHNlbGVjdGlvbgog
ICAtIFJlZGlzLWJhY2tlZCBzZXNzaW9uIGFmZmluaXR5IGFuZCBydW50aW1lIGNvb3JkaW5hdGlv
bgogICAtIGJhY2tlbmQgaGVhbHRoLCBtYWludGVuYW5jZSwgcnVudGltZSBkcmFpbnMgYW5kIHBs
YWNlbWVudCBvdmVycmlkZXMKICAgLSBhbiBPcGVuQVBJLWJhc2VkIFJFU1QgY29udHJvbCBBUEkg
YW5kIGBuYXV0aGlsdXMtZGlyZWN0b3JjdGxgCiAgIC0gbWV0cmljcywgc3RydWN0dXJlZCBsb2dn
aW5nIGFuZCBPcGVuVGVsZW1ldHJ5IHRyYWNpbmcKICAgVGhlIGRlbW8gc3RhY2sgaW5jbHVkZXMg
RG92ZWNvdCBiYWNrZW5kIHNoYXJkcyBhbmQgZXhlcmNpc2VzIHJlYWwgSU1BUCwKICAgTE1UUCwg
UE9QMyBhbmQgTWFuYWdlU2lldmUgcGF0aHMsIHNvIGZlZWRiYWNrIGZyb20gRG92ZWNvdCBvcGVy
YXRvcnMgd291bGQKICAgYmUgZXNwZWNpYWxseSB1c2VmdWwuCiAgIFJlbGF0ZWQgdG8gdGhpcywg
TmF1dGhpbHVzIGl0c2VsZiBoYXMgcmVjZW50bHkgYmVlbiByZWxlYXNlZCBhcyB2ZXJzaW9uCiAg
IDMuMC4wLiBOYXV0aGlsdXMgaXMgdGhlIGNlbnRyYWwgYXV0aGVudGljYXRpb24gYW5kIHBvbGlj
eSBlbmdpbmUgaW4gdGhpcwogICBzZXR1cDogaXQgcHJvdmlkZXMgY2VudHJhbGl6ZWQgYXV0aGVu
dGljYXRpb24gYW5kIGlkZW50aXR5IGhhbmRsaW5nIGZvcgogICBtYWlsIGFuZCB3ZWIgd29ya2xv
YWRzLCBMREFQLWJhY2tlZCBvciBMdWEtZHJpdmVuIHBvbGljeSBkZWNpc2lvbnMsCiAgIE9JREMv
U0FNTCBJZFAgZnVuY3Rpb25hbGl0eSwgTUZBIHN1cHBvcnQsIGFuZCBSZWRpcy1iYWNrZWQgc3Rh
dGUgaGFuZGxpbmcuCiAgIEluIHRoZSBkaXJlY3RvciBhcmNoaXRlY3R1cmUsIE5hdXRoaWx1cyBy
ZW1haW5zIHRoZSBhdXRoZW50aWNhdGlvbiBhbmQKICAgcG9saWN5IGF1dGhvcml0eSwgd2hpbGUg
YG5hdXRoaWx1cy1kaXJlY3RvcmAgb3ducyBjb25jcmV0ZSBiYWNrZW5kCiAgIHBsYWNlbWVudCBh
bmQgcHJveHkgbGlmZWN5Y2xlIGRlY2lzaW9ucy4KICAgUHJvamVjdCBsaW5rczoKICAgLSBuYXV0
aGlsdXMtZGlyZWN0b3I6IGh0dHBzOi8vZ2l0aHViLmNvbS9jcm9lc3NuZXIvbmF1dGhpbHVzLWRp
cmVjdG9yCiAgIC0gTmF1dGhpbHVzOiBodHRwczovL2dpdGh1Yi5jb20vY3JvZXNzbmVyL25hdXRo
aWx1cwogICAtIERvY3VtZW50YXRpb24gLyB3ZWJzaXRlOiBodHRwczovL25hdXRoaWx1cy5vcmcK
ICAgVGhlIGRpcmVjdG9yIGlzIHN0aWxsIHlvdW5nLCBzbyBJIHdvdWxkIGJlIGludGVyZXN0ZWQg
aW4gZmVlZGJhY2sgZnJvbQogICBwZW9wbGUgcnVubmluZyBEb3ZlY290LWJhY2tlZCBpbmZyYXN0
cnVjdHVyZXMsIGVzcGVjaWFsbHkgYXJvdW5kCiAgIG9wZXJhdGlvbmFsIHdvcmtmbG93cywgYmFj
a2VuZCBtYWludGVuYW5jZSwgbWlncmF0aW9uIHNjZW5hcmlvcyBhbmQKICAgcHJvdG9jb2wgYmVo
YXZpb3IuIFRoZSBkaXJlY3RvciBpcyBzdGlsbCBpbiBiZXRhLgogICBCZXN0IHJlZ2FyZHMsCiAg
IENocmlzdGlhbiBSb2Vzc25lcgogICAtLQogICBSb2Vzc25lci1OZXR3b3JrLVNvbHV0aW9ucwog
ICBaZXJ0aWZpemllcnRlciBJVFNpQmUgLyBDSVNPCiAgIE1hcmJ1cmdlciBTdHIuIDcwYSwgMzYz
MDQgQWxzZmVsZAogICBNb2JpbDogKzQ5IDE3MSA5OTA1MzQ1CiAgIFVTdC1JZE5yLjogREUyMjU2
NDM2MTMsIGh0dHBzOi8vcm9lc3NuZXIud2Vic2l0ZQogICBQR1AgZmluZ2VycHJpbnQ6IDY1OEQg
MTM0MiBCNzYyIEY0ODQgMkRERiAxRTg4IDM4QTUgNDM0NiBENzI3IDk0RTUK

--Apple-Mail=_D9EB8C05-ADB8-4B0D-B1B1-5709225A234D--

--===============7647276582508150491==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
dovecot mailing list -- [email protected]
To unsubscribe send an email to [email protected]

--===============7647276582508150491==--