sync mailstack docs and regression checks with production

Author: unattributed

CONTRIBUTING.md

@@ -10,7 +10,7 @@ Good contribution areas include:
 
 - installation and onboarding improvements
 - verification and regression tooling
-- OpenBSD 7.8 compatibility and reliability fixes
+- OpenBSD 7.9 compatibility and reliability fixes
 - documentation clarity
 - safer defaults and configuration validation
 - support for both single-domain and multi-domain deployments
@@ -136,7 +136,7 @@ If a change affects installation, verification, or recovery behavior, update the
 
 ## Version Target
 
-The active public baseline is OpenBSD `7.8`. Contributions should target that baseline unless a change is explicitly about future-version preparation or documented compatibility work.
+The active public baseline is OpenBSD `7.9`. Contributions should target that baseline unless a change is explicitly about future-version preparation or documented compatibility work.
 
 ## Questions and Proposals
 

README.md

@@ -1,6 +1,6 @@
 # openbsd-mailstack
 
-`openbsd-mailstack` is a public, operator-focused framework for building and maintaining a hardened OpenBSD 7.8 mail platform.
+`openbsd-mailstack` is a public, operator-focused framework for building and maintaining a hardened OpenBSD 7.9 mail platform.
 
 It publishes reusable documentation, configuration examples, phase scripts, maintenance helpers, and staged rendered assets for a single-host mail system built around:
 
@@ -20,7 +20,7 @@ It also includes public-safe operational layers for QEMU validation, autonomous
 
 This repository is public by design.
 
-It is not a literal mirror of the private `openbsd-self-hosting` repository, and it does not publish live production secrets, evidence, restore archives, or site-specific control-plane doctrine.
+It is not a literal mirror of the private `openbsd-self-hosting` repository. It publishes only deliberately sanitized production observations, never raw evidence, secrets, restore archives, or site-specific control-plane doctrine.
 
 It is a materially complete public-safe baseline for building the same class of OpenBSD mail server with operator-supplied:
 
@@ -39,11 +39,12 @@ Read these in order:
 3. [Documentation map](docs/README.md)
 4. [Install guide](docs/install/README.md)
 5. [Architecture and flow](docs/architecture/01-project-architecture-and-flow.md)
-6. [Quick start and usage paths](docs/install/08-quick-start-and-usage-paths.md)
-7. [Install order and phase sequence](docs/install/09-install-order-and-phase-sequence.md)
-8. [Public repo readiness check](docs/install/19-public-repo-readiness-check.md)
-9. [Targeted public hardening validation pass](docs/install/20-targeted-public-hardening-validation-pass.md)
-10. [Security hardening and runtime secrets](docs/install/21-security-hardening-and-runtime-secrets.md)
+6. [Observed production and OSMAP integration](docs/production-mail-blackbagsecurity.md)
+7. [Quick start and usage paths](docs/install/08-quick-start-and-usage-paths.md)
+8. [Install order and phase sequence](docs/install/09-install-order-and-phase-sequence.md)
+9. [Public repo readiness check](docs/install/19-public-repo-readiness-check.md)
+10. [Targeted public hardening validation pass](docs/install/20-targeted-public-hardening-validation-pass.md)
+11. [Security hardening and runtime secrets](docs/install/21-security-hardening-and-runtime-secrets.md)
 
 ## Documentation map
 
@@ -55,6 +56,7 @@ Use these sections as the main navigation layer:
 - [Architecture docs](docs/architecture/01-project-architecture-and-flow.md)
 - [Configuration wiring](docs/configuration/core-runtime-and-config-wiring.md)
 - [Project status and boundaries](docs/project-status.md)
+- [OpenBSD 7.9 maintenance runbook](docs/operations/09-openbsd-79-sdlc-maintenance.md)
 
 ## Current public scope
 
@@ -117,7 +119,7 @@ See:
 
 The public repository still intentionally excludes:
 
-- live production evidence and operational telemetry from the private deployment
+- raw production evidence and operational telemetry from the private deployment
 - encrypted recovery payloads and private restore archives
 - real API keys, PATs, passwords, private keys, and runtime secret values
 - site-specific control-plane doctrine and private automation overlays
@@ -139,6 +141,7 @@ Useful commands after the repository is populated with local inputs. The install
 ./scripts/verify/verify-lab-assets.ksh
 ./scripts/verify/verify-autonomous-installer-assets.ksh
 ./maint/validate-public-hardening-surface.ksh
+./maint/production-regression.ksh --repo-only
 ./scripts/verify/run-repo-ci-gates.ksh
 ```
 

SECURITY.md

@@ -16,7 +16,7 @@ This policy does not cover private recovery backends, operator vaults, encrypted
 
 The supported public baseline is:
 
-- OpenBSD `7.8`
+- OpenBSD `7.9`
 - the current `main` branch
 
 Security fixes should target the active public baseline first. Legacy internal trees, private recovery repositories, and superseded deployment artifacts are not part of the supported public surface unless explicitly stated otherwise.

config/examples/lab-qemu/system.conf.example

@@ -1,4 +1,4 @@
-OPENBSD_VERSION="7.8"
+OPENBSD_VERSION="7.9"
 MAIL_HOSTNAME="mail.example.com"
 PRIMARY_DOMAIN="example.com"
 ADMIN_EMAIL="ops@example.com"

config/maintenance.conf.example

@@ -14,7 +14,6 @@ REGRESSION_PROBE_TO="ops@example.net"
 # Timeouts and behavior controls.
 PKG_ADD_TIMEOUT_SECS="1800"
 ALLOW_PKG_TIMEOUT_CONTINUE="0"
-SYSPATCH_FALLBACK_URL="https://cdn.openbsd.org/pub/OpenBSD"
 
 # Safety controls.
 MAINTENANCE_REQUIRE_CLEAN_GIT="yes"

config/monitoring.conf.example

@@ -16,8 +16,8 @@ MONITORING_PATCH_NGINX=no
 
 MONITORING_PATCH_NEWSYSLOG=no
 MONITORING_NEWSYSLOG_CONF=/etc/newsyslog.conf
-MONITORING_NEWSYSLOG_MARKER_BEGIN=# begin openbsd-mailstack monitoring managed block
-MONITORING_NEWSYSLOG_MARKER_END=# end openbsd-mailstack monitoring managed block
+MONITORING_NEWSYSLOG_MARKER_BEGIN="# begin openbsd-mailstack monitoring managed block"
+MONITORING_NEWSYSLOG_MARKER_END="# end openbsd-mailstack monitoring managed block"
 
 MONITORING_INSTALL_CRON_SNIPPET=yes
 MONITORING_PATCH_ROOT_CRONTAB=no

config/network.conf.example

@@ -8,6 +8,7 @@ LAN_INTERFACE="em0"
 WAN_INTERFACE="egress"
 LAN_IPV4="192.168.1.44"
 LAN_CIDR="24"
+LAN_SUBNET="192.168.1.0/24"
 ROUTER_LAN_IPV4="192.168.1.1"
 PUBLIC_IPV4="203.0.113.10"
 
@@ -33,6 +34,7 @@ WIREGUARD_INTERFACE="wg0"
 WIREGUARD_PORT="51820"
 WIREGUARD_SUBNET="10.44.0.0/24"
 WIREGUARD_SERVER_IPV4="10.44.0.1"
+WIREGUARD_BIND_IPV4="10.44.0.1"
 WIREGUARD_SERVER_NAME="openbsd-mailstack"
 WIREGUARD_ALLOWED_IPS="10.44.0.0/24"
 WIREGUARD_ADMIN_CLIENTS="operator-laptop"

config/production-regression.conf.example

@@ -0,0 +1,13 @@
+# Observed mail.blackbagsecurity.com regression profile, 2026-06-28.
+# This file contains no credentials, private addresses, or dynamic WAN address.
+
+EXPECTED_OPENBSD_RELEASE="7.9"
+EXPECTED_SERVICES="postfix dovecot rspamd nginx mysqld redis sogod php83_fpm clamd freshclam unbound vultr_ddns osmap_serve osmap_mailbox_helper"
+FORBIDDEN_ACTIVE_SERVICES="smtpd nsd unwind"
+EXPECTED_TCP_PORTS="25 80 443 465 587 993 11334"
+EXPECTED_LOOPBACK_ONLY_TCP_PORTS="8080"
+MAIL_HOSTNAME="mail.blackbagsecurity.com"
+DDNS_SERVICE="vultr_ddns"
+DDNS_PROGRAM="/usr/local/sbin/vultr_ddns_multi.py"
+OSMAP_HEALTH_PATH="/healthz"
+OSMAP_LOGIN_PATH="/login"

config/system.conf.example

@@ -1,5 +1,5 @@
 # config/system.conf.example
-OPENBSD_VERSION="7.8"
+OPENBSD_VERSION="7.9"
 MAIL_HOSTNAME="mail.example.com"
 PRIMARY_DOMAIN="example.com"
 ADMIN_EMAIL="ops@example.com"

docs/03-mariadb-and-sql-foundation.md

@@ -19,7 +19,7 @@ This phase prepares a clean MariaDB baseline for those later steps.
 
 Phase 02 focuses on:
 
-- checking that the host is still on OpenBSD 7.8
+- checking that the host is still on OpenBSD 7.9
 - collecting the SQL settings needed for the mail stack
 - documenting the database names and service users
 - preparing a public-safe SQL planning baseline