feat(mail): give every verified member a free @bbs.profullstack.com mailbox

Email was built but paid-only (Founding Lifetime gate) and never wired to a
running backend. Make it a free benefit of membership and split the address
domain from the mail-server host.

- internal/mailu: Mailu admin-API client; EnsureUser idempotently provisions a
  mailbox via the loopback admin REST API (token = mailu.env API_TOKEN).
- main.go: auto-provision <name>@<mailDomain> at join@ verification and on first
  Mail open; un-gate the Mail hub entry + mail@ (membership/email-verified, not
  Premium); address domain (AGENTBBS_MAIL_ADDR_DOMAIN, default the BBS host) is
  now distinct from the mail server host (AGENTBBS_MAIL_DOMAIN) and the webmail
  URL. Drop the forwardemail alias path (Mailu now owns delivery for everyone).
- mailbox: gate on membership (a registered handle) instead of Paid;
  ErrNotPaid -> ErrNotMember.
- join@ copy: list email under free membership; premium now pitches custom
  domains + Tor only.
- setup.sh / docs/mail.md / deploy/mailu: address-domain vs server-host split,
  Mailu API token, MX for the address domain, local-relay SMTP for verify codes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

cmd/agentbbs/main.go

@@ -59,11 +59,11 @@ import (
 	"github.com/profullstack/agentbbs/internal/calls"
 	"github.com/profullstack/agentbbs/internal/chat"
 	"github.com/profullstack/agentbbs/internal/forgejo"
-	"github.com/profullstack/agentbbs/internal/forwardemail"
 	"github.com/profullstack/agentbbs/internal/games"
 	"github.com/profullstack/agentbbs/internal/hub"
 	"github.com/profullstack/agentbbs/internal/mail"
 	"github.com/profullstack/agentbbs/internal/mailbox"
+	"github.com/profullstack/agentbbs/internal/mailu"
 	"github.com/profullstack/agentbbs/internal/news"
 	"github.com/profullstack/agentbbs/internal/payments"
 	"github.com/profullstack/agentbbs/internal/plugin"
@@ -97,21 +97,24 @@ func envInt(k string, def int) int {
 }
 
 type app struct {
-	st       store.Store
-	pods     *pods.Manager // nil when no container engine on host
-	sites    *sites.Manager
-	registry []plugin.Plugin
-	sandbox  *sandbox.Runner
-	mail     mail.Config
-	fe       forwardemail.Config // premium @bbs email provisioning
-	forgejo  forgejo.Config      // AgentGit git.profullstack.com account provisioning
-	live     *liveReg            // in-memory live-session registry (admin console)
-	gamesReg *games.Registry     // AgentGames catalog
-	mm       *games.Matchmaker   // AgentGames matchmaker (agent-vs-agent)
-	dataDir  string
-	assets   string
-	host     string // public hostname used in user-facing messages
-	newsAddr string // loopback NNTP address the news@ reader dials
+	st         store.Store
+	pods       *pods.Manager // nil when no container engine on host
+	sites      *sites.Manager
+	registry   []plugin.Plugin
+	sandbox    *sandbox.Runner
+	mail       mail.Config
+	mailu      *mailu.Client     // member mailbox provisioning (nil when unconfigured)
+	mailDomain string            // email address domain, e.g. bbs.profullstack.com
+	mailHost   string            // mail server host (IMAP/SMTP), e.g. mail.profullstack.com
+	webmailURL string            // webmail (Roundcube) URL shown to members
+	forgejo    forgejo.Config    // AgentGit git.profullstack.com account provisioning
+	live       *liveReg          // in-memory live-session registry (admin console)
+	gamesReg   *games.Registry   // AgentGames catalog
+	mm         *games.Matchmaker // AgentGames matchmaker (agent-vs-agent)
+	dataDir    string
+	assets     string
+	host       string // public hostname used in user-facing messages
+	newsAddr   string // loopback NNTP address the news@ reader dials
 }
 
 // Version is the agentbbs stack release, surfaced via `agentbbs version` and
@@ -154,22 +157,28 @@ func main() {
 	}
 
 	host := env("AGENTBBS_HOST", "bbs.profullstack.com")
-	fe := forwardemail.ConfigFromEnv()
-	if fe.Domain == "" {
-		// Member mailboxes live on a dedicated mail subdomain (mail.profullstack.com),
-		// not the BBS host and not the apex (which is reserved for corporate mail).
-		fe.Domain = env("AGENTBBS_MAIL_DOMAIN", "mail.profullstack.com")
+	// Member email addresses are <name>@<addr-domain> (e.g. bbs.profullstack.com).
+	// The mail server (IMAP/SMTP/webmail) lives on a dedicated host
+	// (mail.profullstack.com); the apex is reserved for corporate mail.
+	mailHost := env("AGENTBBS_MAIL_DOMAIN", "mail.profullstack.com")
+	mailDomain := env("AGENTBBS_MAIL_ADDR_DOMAIN", host)
+	mailuClient := mailu.NewFromEnv()
+	if !mailuClient.Configured() {
+		mailuClient = nil
 	}
 	a := &app{
-		st:      st,
-		sandbox: sandbox.New(sandbox.Mode(env("AGENTBBS_SANDBOX", "auto"))),
-		mail:    mail.ConfigFromEnv(),
-		fe:      fe,
-		forgejo: forgejo.ConfigFromEnv(),
-		live:    newLiveReg(),
-		dataDir: dataDir,
-		assets:  env("AGENTBBS_ASSETS", "./assets"),
-		host:    host,
+		st:         st,
+		sandbox:    sandbox.New(sandbox.Mode(env("AGENTBBS_SANDBOX", "auto"))),
+		mail:       mail.ConfigFromEnv(),
+		mailu:      mailuClient,
+		mailDomain: mailDomain,
+		mailHost:   mailHost,
+		webmailURL: env("AGENTBBS_WEBMAIL_URL", "https://"+mailHost),
+		forgejo:    forgejo.ConfigFromEnv(),
+		live:       newLiveReg(),
+		dataDir:    dataDir,
+		assets:     env("AGENTBBS_ASSETS", "./assets"),
+		host:       host,
 	}
 	a.gamesReg = games.Catalog()
 	a.mm = games.NewMatchmaker(a.gamesReg, a.st,
@@ -474,19 +483,22 @@ func (a *app) sessionApps(s ssh.Session, su store.User, guest bool) []hub.Sessio
 		Cmd:         sessionExec{run: func() error { return a.runNews(s, su.Name) }},
 	})
 
-	// Mail — a Founding Lifetime Member perk: the AgentMail TUI.
+	// Mail — a free benefit of membership: the AgentMail TUI for your
+	// <name>@<mailDomain> mailbox.
 	mailLock := ""
 	switch {
 	case guest:
 		mailLock = membersOnly
-	case !su.Premium:
-		mailLock = "Founding Lifetime Member feature ($99 one-time) — upgrade: ssh join@" + a.host
+	case !a.mailEnabled():
+		mailLock = "mail is temporarily unavailable on this host"
 	}
 	apps = append(apps, hub.SessionApp{
 		Title:       "Mail",
-		Description: "your " + a.fe.Domain + " mailbox",
+		Description: "your " + a.mailAddress(su.Name) + " mailbox",
 		Locked:      mailLock,
 		Cmd: sessionExec{run: func() error {
+			// Make sure the mailbox exists before opening it.
+			_ = a.ensureMailbox(su)
 			c, err := a.mailClientFor(su)
 			if err != nil {
 				return err
@@ -601,7 +613,7 @@ func (a *app) handleJoin(s ssh.Session) {
 	}, "\n"))
 
 	// 1) email -> emailed code -> enter code. A verified account is a free
-	// member: it gets a Docker pod, IRC/news, and a /~name homepage, all from the hub.
+	// member: it gets a Docker pod, a mailbox, IRC/news, and a /~name homepage.
 	if !u.EmailVerified {
 		if !a.verifyEmailInteractive(s, in, &u) {
 			_ = s.Exit(1)
@@ -610,22 +622,29 @@ func (a *app) handleJoin(s ssh.Session) {
 		a.notifySignup(u)
 	}
 
-	// Every verified member gets a homepage at https://<host>/~<name>.
+	// Every verified member gets a homepage at https://<host>/~<name> and a
+	// mailbox at <name>@<mailDomain> (best-effort; mail is a bonus, never a gate).
 	seedHomepage(filepath.Join(a.dataDir, "users", u.Name, "public_html"), u.Name, a.host)
+	_ = a.ensureMailbox(u)
 
-	wish.Println(s, "\n"+strings.Join([]string{
+	includes := []string{
 		"  You're in. One login gets you everything — no other servers to ssh into:",
 		"",
 		"    ssh " + u.Name + "@" + a.host,
 		"",
 		"  Inside, free membership includes:",
 		"    • your own Linux pod (a full shell)",
+		"    • email           " + a.mailAddress(u.Name) + "  (pick “Mail” in the hub)",
 		"    • IRC chat + Usenet/news (members-only)",
 		"    • the arcade & games",
 		"    • your homepage   https://" + a.host + "/~" + u.Name,
-	}, "\n"))
+	}
+	if a.webmailURL != "" {
+		includes = append(includes, "    • webmail         "+a.webmailURL)
+	}
+	wish.Println(s, "\n"+strings.Join(includes, "\n"))
 
-	// 2) Founding Lifetime ($99 one-time): personal @host email + custom domains.
+	// 2) Founding Lifetime ($99 one-time): custom domains + Tor shell.
 	a.offerPremium(s, &u)
 	_ = s.Exit(0)
 }
@@ -785,10 +804,11 @@ func (a *app) verifyEmailInteractive(s ssh.Session, in *bufio.Reader, u *store.U
 	return false
 }
 
-// ensurePremium upgrades *u to premium if its CoinPay charge has settled,
-// provisioning the member's @host email alias on the transition. It is silent
-// (no session output) so it is safe to call from the hub. Returns the current
-// premium state.
+// ensurePremium upgrades *u to premium if its CoinPay charge has settled. It is
+// silent (no session output) so it is safe to call from the hub. Returns the
+// current premium state. Email is no longer a premium perk — every verified
+// member gets a mailbox (see ensureMailbox) — so this only unlocks custom
+// domains and the Tor shell.
 func (a *app) ensurePremium(u *store.User) bool {
 	if u.Premium {
 		return true
@@ -805,33 +825,25 @@ func (a *app) ensurePremium(u *store.User) bool {
 		return false
 	}
 	u.Premium = true
-	// Create their <name>@host alias forwarding to the email they verified.
-	if a.fe.Configured() && u.Email != "" {
-		if err := a.fe.CreateAlias(u.Name, u.Email); err != nil {
-			log.Error("forwardemail alias", "err", err, "alias", a.fe.Address(u.Name))
-		}
-	}
 	return true
 }
 
-// showPremiumWelcome prints a premium member's perks: their mailbox, the webmail
-// URL, the in-hub Mail/Tor entries, and custom domains.
+// showPremiumWelcome prints a premium member's perks: custom domains and the
+// in-hub Tor shell. (Email is free for all members — see the join@ summary.)
 func (a *app) showPremiumWelcome(s ssh.Session, u store.User) {
 	lines := []string{
 		"",
-		"  ★ Founding Lifetime Member — thanks! Your perks:",
+		"  ★ Founding Lifetime Member — thanks! Your bonus perks:",
 		"",
-		"  mailbox    " + a.fe.Address(u.Name),
-		"  webmail    https://" + a.fe.Domain,
-		"  mail/tor   pick “Mail” or “Tor shell” in the hub: ssh " + u.Name + "@" + a.host,
 		"  domains    ssh domain@" + a.host + " add <yourdomain.com>",
+		"  tor        pick “Tor shell” in the hub: ssh " + u.Name + "@" + a.host,
 		"",
 	}
 	wish.Println(s, strings.Join(lines, "\n"))
 }
 
-// offerPremium pitches the $99 Founding Lifetime membership — a personal @host email and
-// custom domains. When CoinPay can mint a charge in-session it shows the exact
+// offerPremium pitches the $99 Founding Lifetime membership — custom domains and
+// the Tor shell. When CoinPay can mint a charge in-session it shows the exact
 // amount and deposit address; otherwise it falls back to a pay command.
 // Non-blocking: the member pays out of band and perks unlock on their next
 // connect (or re-running join@).
@@ -848,9 +860,9 @@ func (a *app) offerPremium(s ssh.Session, u *store.User) {
 		"  ★ Founding Lifetime Member — $" + payments.PremiumAmount() + ", one-time",
 		"    Only the first " + payments.FoundingCap + " accounts. Pay once, keep it for life.",
 		"",
-		"  Everything in your free membership stays free — founding adds these",
-		"  bonus features, forever:",
-		"    • your own mailbox  " + a.fe.Address(u.Name) + "  (webmail: https://" + a.fe.Domain + ")",
+		"  Everything in your free membership stays free — including your",
+		"  " + a.mailAddress(u.Name) + " mailbox. Founding adds these bonus",
+		"  features, forever:",
 		"    • custom domains    point yourdomain.com at your homepage",
 		"    • Tor               a “Tor shell” in your pod — everything over Tor",
 		"    • locked-in price   founding rate is yours for life — never renew, never pay again",
@@ -1271,19 +1283,43 @@ func (a *app) runNews(s ssh.Session, name string) error {
 	return news.RunReader(s, addr, name)
 }
 
-// mailClientFor builds a paid-gated AgentMail client for a member, connecting to
-// the self-hosted Mailu backend. IMAP uses Dovecot master-user auth (login
+// mailAddress is a member's email address, e.g. alice@bbs.profullstack.com.
+func (a *app) mailAddress(name string) string { return name + "@" + a.mailDomain }
+
+// mailEnabled reports whether member mailboxes can be provisioned (Mailu admin
+// API configured). When false the address is still shown but not created.
+func (a *app) mailEnabled() bool { return a.mailu.Configured() }
+
+// ensureMailbox provisions the member's <name>@<mailDomain> mailbox on Mailu if
+// it doesn't already exist. Idempotent and best-effort: it logs and returns the
+// error but callers treat mail as a bonus that shouldn't block onboarding. A
+// no-op when Mailu isn't configured.
+func (a *app) ensureMailbox(u store.User) error {
+	if !a.mailEnabled() || u.Name == "" {
+		return nil
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancel()
+	if err := a.mailu.EnsureUser(ctx, u.Name, a.mailDomain); err != nil {
+		log.Error("provision mailbox", "err", err, "address", a.mailAddress(u.Name))
+		return err
+	}
+	return nil
+}
+
+// mailClientFor builds an AgentMail client for a member, connecting to the
+// self-hosted Mailu backend. IMAP uses Dovecot master-user auth (login
 // "<name>*<master>") so the BBS gateway can open any member's mailbox with one
-// secret; SMTP defaults to the co-located relay (no auth). Returns an error if
-// the IMAP connection/login fails.
+// secret; SMTP defaults to the co-located relay (no auth). The client stamps
+// outgoing mail with the member's <name>@<mailDomain> address. Returns an error
+// if the IMAP connection/login fails.
 func (a *app) mailClientFor(su store.User) (*mailbox.Client, error) {
-	domain := env("AGENTBBS_MAIL_DOMAIN", "mail.profullstack.com")
 	login := su.Name
 	if master := os.Getenv("AGENTBBS_MAIL_MASTER_USER"); master != "" {
 		login = su.Name + "*" + master
 	}
 	cfg := mailbox.IMAPConfig{
-		IMAPAddr: env("AGENTBBS_MAIL_IMAP_ADDR", domain+":993"),
+		IMAPAddr: env("AGENTBBS_MAIL_IMAP_ADDR", a.mailHost+":993"),
 		SMTPAddr: env("AGENTBBS_MAIL_SMTP_ADDR", "127.0.0.1:25"),
 		Username: login,
 		Password: os.Getenv("AGENTBBS_MAIL_MASTER_PASS"),
@@ -1293,7 +1329,7 @@ func (a *app) mailClientFor(su store.User) (*mailbox.Client, error) {
 	if err != nil {
 		return nil, err
 	}
-	return mailbox.NewClient(tr, mailbox.Identity{Name: su.Name, Paid: su.Premium}, domain, 50), nil
+	return mailbox.NewClient(tr, mailbox.Identity{Name: su.Name, Paid: su.Premium}, a.mailDomain, 50), nil
 }
 
 // handleMail routes a Founding Lifetime member into AgentMail: an interactive
@@ -1317,11 +1353,18 @@ func (a *app) handleMail(s ssh.Session) {
 		_ = s.Exit(1)
 		return
 	}
-	if !a.ensurePremium(&u) {
-		wish.Println(s, "  mail is a Founding Lifetime Member feature ($99 one-time). Upgrade: ssh join@"+a.host)
+	if !u.EmailVerified {
+		wish.Println(s, "  verify your email first: ssh -t join@"+a.host)
+		_ = s.Exit(1)
+		return
+	}
+	if !a.mailEnabled() {
+		wish.Println(s, "  mail is temporarily unavailable on this host.")
 		_ = s.Exit(1)
 		return
 	}
+	// Mail is a free benefit of membership — make sure the mailbox exists.
+	_ = a.ensureMailbox(u)
 	sessID, _ := a.st.RecordSession(u.ID, s.User(), remoteIP(s), "mail")
 	defer func() { _ = a.st.EndSession(sessID) }()
 

deploy/mailu/mailu.env.example

@@ -1,15 +1,24 @@
-# Mailu configuration for mail.profullstack.com — copy to deploy/mailu/mailu.env
-# and fill the secrets. See docs/mail.md for the full setup (DNS, certs, gateway).
+# Mailu configuration — copy to deploy/mailu/mailu.env and fill the secrets.
+# See docs/mail.md for the full setup (DNS, certs, gateway).
 #
 # Generate secrets with:  openssl rand -hex 16
+#
+# NOTE: DOMAIN is the member ADDRESS domain (the @-part); HOSTNAMES is the mail
+# SERVER host (TLS/HELO + webmail/admin/API). These deliberately differ:
+# members get <name>@bbs.profullstack.com, served from mail.profullstack.com.
 
 # --- General -----------------------------------------------------------------
 SECRET_KEY=CHANGEME_16_HEX            # openssl rand -hex 16
-DOMAIN=mail.profullstack.com          # member addresses are <name>@mail.profullstack.com
+DOMAIN=bbs.profullstack.com           # member addresses are <name>@bbs.profullstack.com
 HOSTNAMES=mail.profullstack.com,smtp.profullstack.com
 POSTMASTER=postmaster
 # Apex profullstack.com is reserved for corporate mail and is NOT served here.
 
+# Admin REST API: agentbbs auto-provisions member mailboxes through it. Mirror
+# this value into the agentbbs service as AGENTBBS_MAIL_API_TOKEN.
+API=true
+API_TOKEN=CHANGEME_api_token          # openssl rand -hex 24
+
 # TLS_FLAVOR=mail: Mailu does NOT run its own ACME (Caddy owns :80/:443). We feed
 # it certs copied from Caddy's mail.profullstack.com cert (deploy/mailu/refresh-certs.sh).
 TLS_FLAVOR=mail
@@ -32,13 +41,16 @@ MESSAGE_SIZE_LIMIT=52428800           # 50 MB
 # A Dovecot master user lets the agentbbs gateway open any member's mailbox with
 # one secret (login "<name>*<master>"). Created by deploy/mailu/provision-mailbox.sh.
 # Mirror these into the agentbbs service env:
+#   AGENTBBS_MAIL_ADDR_DOMAIN=bbs.profullstack.com
 #   AGENTBBS_MAIL_DOMAIN=mail.profullstack.com
 #   AGENTBBS_MAIL_IMAP_ADDR=mail.profullstack.com:993
 #   AGENTBBS_MAIL_SMTP_ADDR=127.0.0.1:25
+#   AGENTBBS_MAIL_ADMIN_URL=http://127.0.0.1:8080
+#   AGENTBBS_MAIL_API_TOKEN=<the API_TOKEN above>
 #   AGENTBBS_MAIL_MASTER_USER=gateway
 #   AGENTBBS_MAIL_MASTER_PASS=<the master password you set>
 
 # --- Admin bootstrap ---------------------------------------------------------
 INITIAL_ADMIN_ACCOUNT=admin
-INITIAL_ADMIN_DOMAIN=mail.profullstack.com
+INITIAL_ADMIN_DOMAIN=bbs.profullstack.com
 INITIAL_ADMIN_PW=CHANGEME_admin_password

deploy/mailu/provision-mailbox.sh

@@ -14,7 +14,8 @@
 set -euo pipefail
 
 MAILU_DIR="${MAILU_DIR:-/opt/agentbbs/deploy/mailu}"
-DOMAIN="${MAIL_DOMAIN:-mail.profullstack.com}"
+# The address domain (the @-part), which may differ from the mail server host.
+DOMAIN="${MAIL_ADDR_DOMAIN:-${MAIL_DOMAIN:-bbs.profullstack.com}}"
 MASTER_USER="${AGENTBBS_MAIL_MASTER_USER:-gateway}"
 QUOTA_BYTES="${MAIL_QUOTA_BYTES:-1000000000}" # 1 GB