service/email.md

@@ -845,6 +845,33 @@ We currently manage Mailman through the `profile::mailman` Puppet
 class, as the [forge modules](https://forge.puppet.com/modules?q=mailman) ([thias/mailman](https://forge.puppet.com/modules/thias/mailman/readme) and
 [nwaller/mailman](https://forge.puppet.com/modules/nwaller/mailman/readme)) are both only for Mailman 2.
 
+Note that the profile currently sets up Mailman with a SQLite
+database, even though it *does* install PostgreSQL and a matching
+user. The configuration of that database user needs to be redone by
+hand after Puppet runs:
+
+    apt purge mailman3 mailman3-web
+    rm -rf /var/spool/postfix/mailman3/data /var/lib/mailman3/web/mailman3web.db
+    apt install mailman3-full
+
+The database password can be found in Trocla, on the Puppet server,
+with:
+
+    trocla get profile::mailman::postgresql_password plain
+
+Note that the `mailman3-web` configuration is particularly
+tricky. Even though Puppet configures Mailman to connect over
+`127.0.0.1`, you *must* choose the `ident` method to connect to
+PostgreSQL in the `debconf` prompts, otherwise `dbconfig-common` will
+fail to populate the database. Once this dance is completed, run
+Puppet again to propagate the passwords:
+
+    pat
+
+The frontend database needs to be rebuilt with:
+
+    sudo -u www-data /usr/share/mailman3-web/manage.py migrate
+
 A site admin password was created by hand with:
 
     django-admin createsuperuser --pythonpath /usr/share/mailman3-web --settings settings --username admin --email postmaster@torproject.org
@@ -893,7 +920,7 @@ postorius.EmailTemplate: (models.W042) Auto-created primary key used when not de
 ```
 
 Those are an instance of a bug specific to bookworm, since then fixed
-upstream and in trixie, see [1082541](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082541).
+upstream and in `trixie`, see [1082541](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082541).
 
 The default `example.com` host was modified by going into the [django
 admin interface](https://lists-01.torproject.org/mailman3/admin/sites/site/), then the `lists-01.torproject.org` "domain" was