From 6e77d1870e5e4d9dec9bafa68cb258b3c7d8f392 Mon Sep 17 00:00:00 2001
From: Viktor Barzin <vbarzin@gmail.com>
Date: Mon, 4 May 2026 07:52:09 +0000
Subject: [PATCH] mailserver: fix e2e probe shell-quoting bug (apostrophe in
 comment)

The 2026-05-02 change that added the Brevo defensive-unblock step
to the email-roundtrip-monitor cron contained an apostrophe in a
Python comment ("wasn't"). The whole script is wrapped in shell
single quotes (python3 -c '...'), so the apostrophe terminated
the shell string. Python only parsed up to the apostrophe and
raised IndentationError on the now-bodyless try: block; everything
after was handed to /bin/sh which complained about "try::" and
unmatched parens. Result: every probe run since 2026-05-02 00:41 UTC
crashed before it could push, and the "Email Roundtrip E2E" Uptime
Kuma push monitor went DOWN with "No heartbeat in the time window".

Fix: rewrite the comment without an apostrophe and add a banner
warning so the next person editing this heredoc does not regress.

Validated: shell parses (bash -n), Python compiles (py_compile)
with the wrapping single quotes intact.
---
 stacks/mailserver/modules/mailserver/main.tf | 23 +++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/stacks/mailserver/modules/mailserver/main.tf b/stacks/mailserver/modules/mailserver/main.tf
index 43a113e3..dd9dd6bf 100644
--- a/stacks/mailserver/modules/mailserver/main.tf
+++ b/stacks/mailserver/modules/mailserver/main.tf
@@ -829,11 +829,32 @@ DOMAIN = "viktorbarzin.me"
 
 marker = f"e2e-probe-{uuid.uuid4().hex[:12]}"
 subject = f"[E2E Monitor] {marker}"
+recipient = f"smoke-test@{DOMAIN}"
 start = time.time()
 success = 0
 duration = 0
 
 try:
+    # Step 0: Defensive unblock. Brevo permanently blocks a recipient after a
+    # single hardBounce — once blocked, every subsequent /smtp/email request
+    # returns 201 but the message is silently dropped (event=blocked).
+    # Single transient pod outage → permanent probe outage. Idempotent: 204 if
+    # the recipient was blocked, 404 if not blocked — both are fine.
+    # NOTE: this script is wrapped in shell single quotes (see the python3 -c
+    # invocation above). Do NOT use apostrophes anywhere here, including in
+    # comments — a stray apostrophe terminates the shell string and Python
+    # only sees the prefix, raising IndentationError on this try block.
+    try:
+        unblock = requests.delete(
+            f"https://api.brevo.com/v3/smtp/blockedContacts/{recipient}",
+            headers={"api-key": BREVO_API_KEY, "Accept": "application/json"},
+            timeout=10,
+        )
+        if unblock.status_code == 204:
+            print(f"WARN: {recipient} was blocked at Brevo, unblocked")
+    except Exception as ue:
+        print(f"Unblock attempt failed (non-critical): {ue}")
+
     # Step 1: Send via Brevo Transactional Email API to smoke-test@ (hits catch-all -> spam@)
     resp = requests.post(
         "https://api.brevo.com/v3/smtp/email",
@@ -844,7 +865,7 @@ try:
         },
         json={
             "sender": {"name": "Monitoring", "email": f"monitoring@{DOMAIN}"},
-            "to": [{"email": f"smoke-test@{DOMAIN}"}],
+            "to": [{"email": recipient}],
             "subject": subject,
             "textContent": f"E2E email monitoring probe {marker}. Auto-generated, will be deleted.",
         },