chore(mailu): pin Docker network subnet to match SUBNET; ignore runtime state

The base compose declares no network, so Docker assigns the default bridge an
arbitrary subnet that won't match mailu.env SUBNET — breaking Mailu's internal
service auth/relay. Add a docker-compose.override.yml.example that pins the
default network to 192.168.203.0/24, and gitignore the live override + Mailu
runtime state (mailu.env, certs/, data/).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

.gitignore

@@ -6,5 +6,11 @@
 *.log
 .env
 
+# Mailu runtime: secrets, local network override, and state
+deploy/mailu/mailu.env
+deploy/mailu/docker-compose.override.yml
+deploy/mailu/data/
+deploy/mailu/certs/
+
 # Claude Code local worktrees/state
 .claude/

cmd/agentbbs/main.go

@@ -73,9 +73,9 @@ import (
 	"github.com/profullstack/agentbbs/internal/store"
 	"github.com/profullstack/agentbbs/internal/tor"
 	"github.com/profullstack/agentbbs/plugins/about"
-	"github.com/profullstack/agentbbs/plugins/hello"
 	"github.com/profullstack/agentbbs/plugins/agentgames"
 	"github.com/profullstack/agentbbs/plugins/arcade"
+	"github.com/profullstack/agentbbs/plugins/hello"
 	"github.com/profullstack/agentbbs/plugins/members"
 	qryptinviteplugin "github.com/profullstack/agentbbs/plugins/qryptinvite"
 )
@@ -1339,14 +1339,16 @@ func (a *app) ensureMailbox(u store.User) error {
 
 // mailClientFor builds an AgentMail client for a member, connecting to the
 // self-hosted Mailu backend. IMAP uses Dovecot master-user auth (login
-// "<name>*<master>") so the BBS gateway can open any member's mailbox with one
+// "<addr>*<master>") so the BBS gateway can open any member's mailbox with one
 // secret; SMTP defaults to the co-located relay (no auth). The client stamps
 // outgoing mail with the member's <name>@<mailDomain> address. Returns an error
 // if the IMAP connection/login fails.
 func (a *app) mailClientFor(su store.User) (*mailbox.Client, error) {
-	login := su.Name
+	// Mailu keys mailboxes by full address, so the IMAP login (and the master
+	// login "<addr>*<master>") must use the address, not the bare handle.
+	login := a.mailAddress(su.Name)
 	if master := os.Getenv("AGENTBBS_MAIL_MASTER_USER"); master != "" {
-		login = su.Name + "*" + master
+		login = a.mailAddress(su.Name) + "*" + master
 	}
 	cfg := mailbox.IMAPConfig{
 		IMAPAddr: env("AGENTBBS_MAIL_IMAP_ADDR", a.mailHost+":993"),

deploy/mailu/docker-compose.override.yml.example

@@ -0,0 +1,14 @@
+# docker-compose.override.yml — copy to docker-compose.override.yml (gitignored).
+#
+# The base docker-compose.yml does not declare a network, so Docker would assign
+# the project's default bridge an arbitrary subnet. Mailu trusts SUBNET (from
+# mailu.env) as its internal network for service-to-service auth and relaying, so
+# the real network subnet MUST equal SUBNET or internal auth/relay breaks. This
+# override pins the default network to the same subnet you set as SUBNET in
+# mailu.env (default 192.168.203.0/24). Compose loads this file automatically.
+networks:
+  default:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 192.168.203.0/24