gdo: the code that opens the iris

A durable consumer on portal's WORMHOLE stream, each message handed to
the host's SMTP as text with an HTML alternative; acked on acceptance,
retried after a minute otherwise, left for a newer gdo when the
contract version is unknown. `gdo probe <to>` sends one through and
waits for the consumer to drain. GDO_TYPST_THEME attaches a Typst PDF.
A systemd unit and an installer for one gdo per host.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

deploy/gdo.service

@@ -0,0 +1,21 @@
+# One per host, not per site: every portal instance on the host
+# publishes to the same WORMHOLE stream, and each message carries its
+# own sender. Install with deploy/install.sh.
+[Unit]
+Description=gdo - delivers portal's outgoing mail to the host's SMTP
+After=network-online.target nats-server.service postfix.service
+Wants=network-online.target
+
+[Service]
+ExecStart=/usr/local/bin/gdo
+EnvironmentFile=-/etc/gdo.env
+DynamicUser=yes
+Restart=always
+RestartSec=5
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+
+[Install]
+WantedBy=multi-user.target

deploy/install.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Install or upgrade gdo on this host from a Gitea release. Run as root:
+#   sudo sh install.sh v0.1.0 [nats://user:pass@127.0.0.1:4222]
+# The NATS URL is only needed the first time; it lands in /etc/gdo.env,
+# which is the one file with a secret in it (mode 0600).
+set -eu
+tag=${1:?usage: install.sh vX.Y.Z [NATS_URL]}
+base=https://project.uhhm.no/uhhm/gdo
+tmp=$(mktemp)
+curl -sfL "$base/releases/download/$tag/gdo" -o "$tmp"
+install -m 0755 "$tmp" /usr/local/bin/gdo
+rm -f "$tmp"
+if [ ! -f /etc/gdo.env ]; then
+  nats=${2:-nats://127.0.0.1:4222}
+  umask 077
+  printf 'NATS_URL=%s\nSMTP_HOST=127.0.0.1\nSMTP_PORT=25\nSMTP_HELO=%s\n# GDO_TYPST_THEME=/etc/gdo/theme.typ\n' "$nats" "$(hostname -f 2>/dev/null || cat /etc/hostname)" > /etc/gdo.env
+fi
+curl -sfL "$base/raw/tag/$tag/deploy/gdo.service" -o /etc/systemd/system/gdo.service
+systemctl daemon-reload
+systemctl enable --now gdo
+systemctl restart gdo
+sleep 2
+systemctl is-active gdo && /usr/local/bin/gdo --version