Secure, mutually-authenticated mail connectivity between all nodes: Taylor UUCP carried over stunnel-terminated TLS, one private CA, a fixed set of named peers. This is what SMTP does not give you by default between hosts — STARTTLS is strippable, trust rests on public CAs and DNS, and a message can cross a relay nobody chose. The goal here is the opposite shape: every hop mutually authenticated, no discovery, no trust-on-first-use. See uucp/handover-next-actions for the full statement of intent.
radagast added 2026-10-03 via virtio-serial links. Bidirectional UUCP mail (pomelo↔radagast) working as of 2026-10-04. Internet-bound outbound mail from radagast remains gated off.
radagast added 2026-10-03 via virtio-serial link. Inbound mail (pomelo→radagast) working. Outbound from radagast gated off.
Internal host-to-host mail is enabled as authorised on 2026-09-20. Internet mail integration remains gated off; no popit3, Envoy or IMAP connection was added. Read the local /var/mail/<user> mailboxes. Existing unrelated mail configurations remain separate.
uucp/key-distribution — plan: distribute SSH public keys to authorized_keys over this mesh, gated by ssh-keygen -Y sign/verify rather than by UUCP command allow-listing. Per-target-user systemd daemons, never a privileged one. Proof scoped to pomelo/john first.
uucp/setup-status — architecture, port scheme, authentication, TLS integration, and the gotchas (public-dir permissions, compiled-in lock path, FQDN-only resolution between EC2 hosts).
uucp/handover-next-actions — the actual handover/next-actions note: what's done, what's paused and why, what to do when work resumes, and the FreeBSD-node build options. Named handover-next-actions rather than uucp/next-actions for historical reasons — not renamed.
uucp/radagast — radagast-specific: two virtio-serial links, socat PTY bridges on pomelo, getty login-chat (link 1), uucico -l answer service (link 2), Upomelo/Uradagast users, sendmail config with mailertable, Postfix transport and mydestination. Bidirectional mail with pomelo; Internet-outbound gated off.
ansible — the roles/uucp ansible role, uucp.yml, uucp_topology.yml drive all three nodes.
ssl — the shared stunnel PKI (one self-signed CA) that UUCP's TLS layer reuses rather than inventing its own.
popit3 — inbound mail arrives via popit3, not via UUCP, once the mail layer exists.
PROGRAMMING_RULES/freebsd-build-from-source — build-from-source policy that applies when a FreeBSD node joins this network.
uucp/mail — deployed internal mail, short addresses, configurable hub, polling, Ansible setup and host onboarding.