rebuild architecture diagrams (tpo/tpa/team#41009) (01d4b1c4) · Commits · The Tor Project / TPA / Wiki Replica

policy/tpa-rfc-44-email-emergency-recovery/architecture-post.dot

+32 −18

Original line number	Diff line number	Diff line
		digraph email {
		label="Email architecture TPA-RFC-44 long term plan\ntorproject.org, December 2022"
		label="Email architecture TPA-RFC-44 long term plan\ntorproject.org, June 2024"
		labelloc=bottom
		compound=true

		node [shape=rectangle]

		// a user
		@@ -9,32 +11,44 @@ digraph email {
		// all other boxes that don't do anything special with email
		tpoboxes [label="other TPA hosts"]
		// hosts that manage and send their own email
		mailhosts [color="orange" label="mail hosts\ngitlab, RT, CiviCRM"]
		submission [color="orange"]
		mailhosts [label="mail hosts\ngitlab, RT, CiviCRM"]
		submission
		// new machines
		relay [color="green" label="MTA"]
		mx [color="green"]
		mailbox [color="green" label="mailbox\nIMAP, webmail"]
		lists [color="green" label="lists\nschleuder, mm 3"]
		relay [color="green" style=filled label="MTA\nrewriting"]
		mx [color="green" style=filled label="mx\nrewriting"]
		subgraph "clustermailboxes" {
		label="high availability storage cluster"
		style=dotted

		mailbox0 [color="green" style=filled label="mailbox0\nDovecot"]
		mailbox1 [color="green" style=filled label="mailbox1\nDovecot\nfailover"]
		webmail0 [color="green" style=filled label="webmail0\nRoundcube"]
		webmail1 [color="green" style=filled label="webmail1\nRoundcube"]
		}
		{ webmail0, webmail1 } -> mailbox0
		{ webmail0, webmail1 } -> mailbox1 [style="dotted"]
		mailbox0 -> mailbox1 -> mailbox0
		lists [color="green" style=filled label="lists\nschleuder\nmailman 3"]

		// external boxes
		dotdotdot [label="internet\nnon TPO mail hosts", shape=ellipse]
		// other hosts that currently masquerade as us
		masquerade [label="impersonators\nriseup, gmail, etc"]

		// all relations

		// mx receives email from everywhere and forwards it
		dotdotdot -> mx [label="SMTP"]
		mx -> { mailbox, mailhosts, lists, masquerade } [label="SMTP"]
		dotdotdot -> { mailhosts, lists } [label="SMTP"]
		dotdotdot -> mx
		mx -> { mailhosts, lists, dotdotdot, mailbox0 }
		mx -> mailbox1 [style=dotted]
		dotdotdot -> { mailhosts, lists }
		// user interacts with those
		user -> { mailhosts, lists } [label="HTTP"]
		user -> submission [label="SMTP"]
		user -> mailbox [label="IMAP, HTTP"]
		user -> { mailhosts, lists, submission }
		user -> { webmail0, webmail1 } [dir=both]
		user -> mailbox0 [dir=both]
		user -> mailbox1 [dir=both style="dotted"]
		// those all relay mail to the outside
		{ submission, mailhosts, lists, relay } -> dotdotdot [label="SMTP"]
		{ submission, mailhosts, lists, relay } -> dotdotdot
		submission -> {mx, lists, mailhosts, mailbox0}
		submission -> mailbox1 [style=dotted]
		// except those, who still go through the relay
		tpoboxes -> relay [label="SMTPS"]
		masquerade -> dotdotdot [style=tapered color=red label="SMTP, failing"]
		tpoboxes -> relay
		}

policy/tpa-rfc-44-email-emergency-recovery/architecture-post.png

+37.7 KiB (117 KiB)

Loading image diff...

policy/tpa-rfc-44-email-emergency-recovery/architecture-pre.dot

+9 −10

Original line number	Diff line number	Diff line
		digraph email {
		label="Email architecture, torproject.org, April 2022"
		label="Email architecture, torproject.org, June 2024"
		labelloc=bottom
		node [shape=rectangle]

		@@ -10,10 +10,10 @@ digraph email {
		// all other boxes that don't do anything special with email
		tpoboxes [label="other TPA hosts"]
		// hosts that manage and send their own email
		mailhosts [color="orange" label="mail hosts\ngitlab, RT, CiviCRM"]
		submission [color=orange]
		mailhosts [label="mail hosts\ngitlab, RT, CiviCRM"]
		submission
		// legacy
		eugeni [color=red label="eugeni\nmailman, schleuder\nmx, relay"]
		eugeni [style=filled label="eugeni\nmailman, schleuder\nmx, MTA"]
		// external boxes
		dotdotdot [label="internet\nnon TPO mail hosts", shape=ellipse]
		// other hosts that currently masquerade as us
		@@ -23,15 +23,14 @@ digraph email {

		// eugeni handles basically everything except some rare
		// exceptions on mailhosts
		dotdotdot -> { mailhosts, eugeni } [label="SMTP"]
		{submission, dotdotdot} -> { mailhosts, eugeni }
		// users interact with those
		user -> submission [label="SMTP"]
		user -> eugeni [label="HTTP, SMTP"]
		user -> submission
		user -> eugeni [label="HTTP\nSMTP"]
		user -> mailhosts [label="HTTP"]
		// those all relay mail to the outside
		{ submission, mailhosts, eugeni, masquerade } -> dotdotdot [label="SMTP"]
		{ submission, mailhosts } -> dotdotdot
		eugeni -> dotdotdot [color=orange label="unreliable"]
		// except those, who still go through the relay
		tpoboxes -> eugeni [label="SMTPS"]
		// eugeni also forwards mails to the impersonators
		eugeni -> masquerade [label="SMTP"]
		}

policy/tpa-rfc-44-email-emergency-recovery/architecture-pre.png

+6.13 KiB (56.1 KiB)

Loading image diff...

policy/tpa-rfc-45-mail-architecture.md

+4 −6

Original line number	Diff line number	Diff line
		@@ -679,7 +679,7 @@ using tools they don't want.
		## Architecture diagram

		TODO: rebuild architecture diagrams, particularly add a second HA
		stage and show the current failures more clearly.
		stage and show the current failures more clearly, e.g. forwards

		The architecture of the final system proposed here is similar to the
		one proposed in the [TPA-RFC-15 diagram][], although it takes it a
		@@ -689,11 +689,9 @@ step further and retires eugeni.

		Legend:

		* red: legacy hosts, mostly eugeni services, no change
		* orange: hosts that manage and/or send their own email, no change
		except the mail exchanger might be the one relaying the
		`@torproject.org` mail to it instead of eugeni
		* green: new hosts, might be multiple replicas
		* gray: legacy host, mostly eugeni services, split up over time and retired
		* orange: delivery problems with the current infrastructure
		* green: new hosts, MTA and mx can be trivially replicated
		* rectangles: machines
		* triangle: the user
		* ellipse: the rest of the internet, other mail hosts not managed by tpo