amadan
Tenant email config on the flagship box is not in IaC — a rebuild silently loses it Issue open
Migrated from github.com/carlosframework/platform issue #269, opened 2026-08-23. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: The four CARLOSMAIL* vars are in no IaC or bootstrap path, so a box rebuild silently loses tenant email.
---
grep -r CARLOS_MAIL across platform-infrastructure returns nothing.
The flagship console's tenant email is switched on by three variables in /etc/carlos/host.env on i-092c0c1eea75723cb, set by hand on 2026-08-23:
CARLOS_MAIL_REGION=eu-west-1
CARLOS_MAIL_PLATFORM_SUFFIX=oncarlos.com
CARLOS_MAIL_OPERATORS=…No terraform, no script, and no runbook records them. bootstrap-box.sh would rebuild that box without tenant email, and nothing would fail loudly — the console starts fine, MailProvisioner is nil, and every email door simply answers 404. Tenants would stop being able to enable sending, and existing senders would keep working (their IAM credentials live on, independent of the console), so the failure would present as "the email API disappeared" rather than as an outage anyone could trace to a rebuild.
Worth fixing alongside the SNS wiring, since that adds a fourth variable (CARLOS_MAIL_SNS_TOPIC_ARN) with the same property — and the topic ARN is one a rebuild could not even guess, because it is a terraform output.
The IAM half is already in IaC (aws_iam_role_policy.host_ie_tenant_mail, applied 2026-08-23), so this is specifically the env-var half that is undeclared.