The alert that crossed the water¶

Before the move, the message that told Golem Trust its own infrastructure was on fire had to leave the continent to arrive. Outbound alerts and notifications went through Fastmail’s SMTP relay, smtp.fastmail.com, on an app-specific password, and the internal relay, mail.golems.internal, carried what stayed inside. Fastmail is an Australian company, well run and nothing to do with the United States. It is in the graph on purpose, because the exercise is to know where each dependency sits and choose it deliberately. The scraps for this layer say: the nervous system of a provider has no business running through a country nobody chose for the job.

What the relay carries¶

This is the operational signal: the vault’s health, the log pipeline’s alerts, the certificate-expiry warnings, the pager’s overflow to email. It is low in volume and high in consequence, because it is the layer that tells a human something has gone wrong, and a relay that is slow, blocked or gone on the wrong morning is a fire nobody hears about until the smoke reaches them.

A European relay, or none at all¶

Two changes, in order. Most of the signal never needed to leave the building, so it moved to the internal relay, mail.golems.internal, which is Golem Trust’s own and reaches Golem Trust’s own people. What genuinely has to arrive at a human off the network, Dr Crucible’s personal inbox at three in the morning, goes through a European provider, mailbox.org of Berlin, on its own servers. Dr Crucible, on call more nights than is strictly fair, has strong views on being told of a fire in Helsinki by way of Melbourne. The app password at an Australian company became a relay it either owns outright or rents inside Europe.

The relay¶

   before                              after

   internal alerts ─┐                  internal alerts ──► mail.golems.internal (own)
                    ├─► Fastmail (AU)        │
   off-network ─────┘                  off-network ──────► mailbox.org (Berlin)

The operational signal that stays inside kept on its own relay, the little that has to reach a human off the network moved to a European provider, and the Australian hop taken out of the one message a provider cannot afford to lose.

What could go wrong?

• mailbox.org suspends the account, and the off-network alerts change to another European relay within the day, while the internal signal never touched it.

• The internal relay is where the fire is, and the alert about it cannot get out, and the off-network path exists for exactly that, on a different provider on different infrastructure.

• An app password at the old provider is left active after the move, a quiet outbound account nobody is watching any more.

Tiffany Aching sends word across the Chalk by shepherds, who lose the exact words and keep the meaning, and have never once needed a relay in another country to do it.