Symptom
Nobody can register. ssh join@bbs.profullstack.com creates the account, then fails at the email step and disconnects:
Email: someone@example.com
couldn't email the code; please retry or contact an admin.
Connection to bbs.profullstack.com closed.
Reproduced against production on 2026-09-22 with a throwaway key.
Broken since 2026-09-13. The last "New AgentBBS signup" notification email is dated 2026-09-02 — that notification goes through the same sender, so it went silent at the same time.
Cause
Caddy owns ACME for mail.profullstack.com and renewed on 2026-08-14 (valid to Nov 12). Mailu kept serving the certificate it loaded at container start — Jun 15 → Sep 13. Once that expired, the STARTTLS handshake in internal/mail failed verification and every transactional send died with it: join@ confirmation codes, signup notifications, notify-creds.
On the live host:
| endpoint |
serves |
expires |
:443 (Caddy) |
renewed cert |
Nov 12 2026 ✅ |
:25 / :465 / :993 (Mailu) |
stale cert |
Sep 13 2026 ❌ |
Three things let one stale certificate take registration down:
setup.sh installed the cert refresher and enabled its timer, but never ran it — systemctl enable --now <timer> starts the timer, not the service, so a redeploy left the stale cert in place.deploy/mailu/refresh-certs.sh only compared files, so a copy whose reload silently failed left a fresh cert on disk and an expiring one on the wire, invisibly. It also swallowed the docker compose restart failure.internal/mail verified the relay's certificate even on loopback, where there is nothing to intercept — so an on-box cert lapse could hard-fail a signup.
Fix
PR #129 (CI green). Merging it and letting agentbbs-update.timer redeploy repairs the live cert.
To repair the box immediately instead:
sudo /usr/local/bin/agentbbs-mailu-certs
# verify what is actually on the wire, not what is on disk:
printf 'QUIT\r\n' | openssl s_client -quiet -starttls smtp \
-connect 127.0.0.1:25 -servername mail.profullstack.com 2>&1 | grep -i notAfter
Cleanup
Reproduction left an unverified account regtest0922 on prod — safe to delete.
Symptom
Nobody can register.
ssh join@bbs.profullstack.comcreates the account, then fails at the email step and disconnects:Reproduced against production on 2026-09-22 with a throwaway key.
Broken since 2026-09-13. The last "New AgentBBS signup" notification email is dated 2026-09-02 — that notification goes through the same sender, so it went silent at the same time.
Cause
Caddy owns ACME for
mail.profullstack.comand renewed on 2026-08-14 (valid to Nov 12). Mailu kept serving the certificate it loaded at container start — Jun 15 → Sep 13. Once that expired, the STARTTLS handshake ininternal/mailfailed verification and every transactional send died with it:join@confirmation codes, signup notifications,notify-creds.On the live host:
:443(Caddy):25/:465/:993(Mailu)Three things let one stale certificate take registration down:
setup.shinstalled the cert refresher and enabled its timer, but never ran it —systemctl enable --now <timer>starts the timer, not the service, so a redeploy left the stale cert in place.deploy/mailu/refresh-certs.shonly compared files, so a copy whose reload silently failed left a fresh cert on disk and an expiring one on the wire, invisibly. It also swallowed thedocker compose restartfailure.internal/mailverified the relay's certificate even on loopback, where there is nothing to intercept — so an on-box cert lapse could hard-fail a signup.Fix
PR #129 (CI green). Merging it and letting
agentbbs-update.timerredeploy repairs the live cert.To repair the box immediately instead:
Cleanup
Reproduction left an unverified account
regtest0922on prod — safe to delete.