# Questions — v8 (current round)

v7's PMG round is partially resolved — the 2026-09-03 mail audit (55
systems, read-only) answered several questions with ground truth and
Charles answered others in chat. Answers recorded below; new questions
PQ8–PQ10 need your go. Full map + deploy plan:
[Discourse t/322](https://community.turnsys.com/t/322).

## PMG round — resolved

**PQ1 (backend).** ✅ Cloudron VPS confirmed as backend:
`mail.knownelement.com` (152.53.37.179). Audit adds: public MX already
points there; fleet delivers direct today; knel.net zone has no MX.

**PQ3 (outbound smarthost).** ✅ Charles ruled: all hosts send through
a shared **VIP** in front of the PMG pair. (Mechanics in PQ8 below.)

**PQ4 (placement/sizing).** ✅ Resolved by reality: the pair already
exists — VM 604 on tsys6 (192.168.1.11) and VM 711 on tsys7
(192.168.1.10), both 2vCPU/4G/32G, running, onboot, PMG 9.1.0
installed, unclustered, default config. Nothing to build; configure
only.

**"Old relay in postfix?"** ✅ None. `relayhost` is empty on every
audited system (16 postfix installs); no ssmtp/msmtp/nullmailer
anywhere. Fleet sends direct-to-MX today.

## PMG round — still open

**PQ2 (inbound path).** Where does public :25 DNAT land — rrinfra
Cisco? Any existing mail port-forwards? (Founder-side; only needed
before the MX cut-over, not for outbound value.)

**PQ5 (native PMG cluster?).** Recommended: yes — config + quarantine
replication between .1.11/.1.10, managed strictly serial. OK?

**PQ6 (TLS from fleet CA #697?).** Recommended: yes for the two admin
UIs; SMTP stays opportunistic. OK?

**PQ7 (notify address).** Evidence says the pair already forwards to
`coo@turnsys.com`. Confirm that address for quarantine digests + PMG
alerts?

**PQ8 (VIP specifics).** Proposal: **VIP 192.168.3.249** (pool ends
.3.200; .250-.254 is your infra block), keepalived VRRP VRID 10 on the
pair, dhcpd host-declaration pin (VRRP MAC 00:00:5e:00:01:0a), DNS A
record `smtp.knel.net` → 192.168.3.249. Confirm the number + name, or
name your preferred slot.

**PQ9 (outbound cutover staging).** Recommended: serial staged — PVE
hosts + PBS first (verify a week), then the VM postfix set, one
blue/green hop at a time. OK, or all at once?

**PQ10 (side findings — sub-tickets?).** (a) tsys-ucs-02 root alias
blackholes to `systemmail@unassigned-hostname...`; (b) Wazuh alerting
never configured (stock example smtp). Fix as ride-alongs in #696 or
separate sub-tickets? (Will create them either way — just tell me
where they land.)

## Carried from v6 — still open

**Q4. Second human approver in gitea?** "Planned for very near
future"; until then KNEL/access-roster merges are impossible by
design. Does not block code/deploy work.

## Carried from v7 — superseded questions

PQ1/PQ3/PQ4 answers above replace the v7 wording; v7 file remains in
git history.