Skip to content
Project Loom

Email

Apps send email (sign-in links, documents, Keycloak password resets) through OCI Email Delivery, Oracle’s outbound SMTP service, in the same tenancy and region as the node (af-johannesburg-1). Nothing runs in the cluster for it. An app connects out to OCI on port 587, logs in with its own SMTP credentials, and OCI delivers the mail.

flowchart LR
  subgraph node[k3s node]
    App[<app> pod]
    KC[Keycloak]
  end
  Vault([Infisical: SMTP_*]) -->|envFrom| App
  App -->|SMTP 587 STARTTLS<br/>SMTP &lt;App&gt; credentials| OCI[OCI Email Delivery]
  KC -->|SMTP 587 STARTTLS<br/>SMTP Keycloak credentials| OCI
  OCI -->|DKIM-signed as<br/>mail.visarend.systems| Inbox([recipient])

What it needs

Section titled “What it needs”

OCI Email Delivery is the chosen relay. Everything else is whatever the domain already uses:

NeedsThis setup
An SMTP relay that signs with DKIMOCI Email Delivery
A DNS host for the domain (CNAME and TXT records)Cloudflare
A mailbox with aliases, to receive OCI account noticesZoho Mail
Any inbox you can read, to test deliveryGmail

Swapping the DNS host or mail provider changes where the records and aliases are made, not the design.

Shared once, isolated per app

Section titled “Shared once, isolated per app”
Shared by every app (set up once)One per app
Compartment emailCompartment email-<app>, inside email
Email domain mail.visarend.systems and its DKIM keyApproved sender <app>@mail.visarend.systems
DKIM, SPF and DMARC DNS records on mailOCI user SMTP <App> and group email-<app>
Policy email-apps-send (one line per app)SMTP credentials, in the app’s Infisical project
The oci@visarend.systems mailbox for OCI noticesAlias oci-<app>@visarend.systems for that user’s notices
OCI sending limits and the SMTP endpoint

Why per-app compartments. OCI grants the right to send per compartment. Each app’s approved sender sits in its own compartment and each app’s group may only use approved-senders there, so a leaked password can send as that one app and nothing else, and revoking one app never touches the others.

Why a mail. subdomain. visarend.systems itself belongs to its mailbox provider (here Zoho Mail), which owns its MX, SPF and DKIM records. Sending app mail from mail.visarend.systems gives it its own SPF record and reputation, so the provider’s records are never edited and a spam complaint about app mail can’t hurt the mailboxes.

What is still shared. Every app draws on the same OCI sending quota and the same domain reputation. An app that ever sends heavy or risky mail gets its own subdomain (one more email domain, DKIM key and DNS set); the app itself doesn’t change.

Where each address goes

Section titled “Where each address goes”

Two addresses per app look alike and must not be swapped:

AddressUsed as
<app>@mail.visarend.systemsOCI approved sender, and the app’s MAIL_FROM
oci-<app>@visarend.systemsEmail of the OCI user SMTP <App>. Receives OCI notices only

Using the notices alias as the approved sender makes OCI refuse every message with 535 Authorization failed: Envelope From address … not authorized (Troubleshooting).

Where it’s set up

Section titled “Where it’s set up”