carlos / platform Public

cmd/console: document CARLOS_CONSOLE_MAIL_FROM

Task 7 of the console invite delivery work: the whole-branch gate.
Documents the console's own email env var and its infra tie-in
(infra/modules/region-host's console_mail_from/console_mail_region)
in the package doc comment, right after the tenant-email paragraph.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 2 weeks ago 46897890f02702430ceb78a3b133ccdd5d20bd69 parent b89196e

1 file changed, +11 −0

cmd/console/main.go +11 −0

diff --git a/cmd/console/main.go b/cmd/console/main.go

index b0a97bbdd..53f119a68 100644

--- a/cmd/console/main.go

+++ b/cmd/console/main.go

@@ -65,6 +65,17 @@

// field nil rather than stopping the console from booting — see

// mailBackends' doc comment.

+// The console's own email (the invite fallback when Keymail cannot deliver)

+// sends From CARLOS_CONSOLE_MAIL_FROM, defaulting to

+// noreply@console.bab.<CARLOS_MAIL_PLATFORM_SUFFIX> when the suffix is set.

+// It needs CARLOS_MAIL_REGION (a mail Provisioner) and the host role's

+// ses:SendEmail grant from infra/modules/region-host's console_mail_from and

+// console_mail_region variables, which must equal the resolved From and

+// CARLOS_MAIL_REGION. With neither a From nor a suffix there is no console

+// email, and invites go by Keymail or by hand. If the domain is already an

+// SES identity the console did not create, mail.EnsureDomain refuses it

+// until a _carlos-mail.<domain> TXT proof is published (#216).

+//

// grant/revoke/owners need only CONSOLE_DB.

package main