Bardin Gate AMG
A relay that leaves nothing open
Who may connect
AMG is an entry point for email, so it answers the hardest question first: who may connect to me? The answer is two IP addresses and no others, and the rest of the design keeps that answer true for the life of the appliance.
| Control | How it works |
|---|---|
| Allowed addresses | Only a direct connection from the two configured addresses is admitted. Each is an IPv4 or IPv6 address written as numbers; a host name in that field is refused. |
| No DNS, no MX | Connections always go straight to that IP address. The host name is only the peer's identity and the name expected in its certificate. |
| TLS | Required by default, with the peer's certificate validated without exception. Opportunistic or off needs an explicit warning and an audited change. |
| Mutual TLS and SMTP AUTH | Optional, set for each side. Certificates, keys and passwords are held only as references to the appliance's secret store. |
| Direction | From the peer's address only; changing a message cannot change it. |
An unknown peer, the same address on both sides, an invalid TLS identity, a missing secret, an ambiguous direction or a malformed configuration are all refused.
The mail system and the queue
| Area | How it is protected |
|---|---|
| The mail system | Runs rootless with a read-only root, AppArmor, seccomp and resource limits, with no extra system privileges, apart from the rest of the appliance's software. |
| The queue | Sits on the appliance's encrypted data volume (LUKS2, AES-256-XTS); RAID tolerates the failure of one disk. |
| Secrets | Private keys and passwords never enter the configuration file, logs, database, diagnostics or SIEM. |
The privacy of content
Bodies, attachments and subjects never appear in logs, metrics, stored metadata or SIEM events. In the SIEM, sender and recipient addresses are replaced by a stable keyed pseudonym by default; showing them in full is an explicit choice with a warning and an audit record.
Talk to our specialists
Tell us about your environment and what you need. One of our specialists will answer you.