@serve.zone/dcrouter 15.6.1 → 15.7.0

package/ts/classes.dcrouter.ts

@@ -14,6 +14,8 @@ import {
   type IExtendedSmtpSession,
   type IMessageAcceptanceContext,
   type IMessageAcceptanceDecision,
+  type IOutboundConnectionProxy,
+  type IOutboundConnectionProxyContext,
 } from '@push.rocks/smartmta';
 import { logger } from './logger.js';
 import { StorageBackedCertManager } from './classes.storage-cert-manager.js';
@@ -39,7 +41,7 @@ import { AcmeConfigManager } from './acme/manager.acme-config.js';
 import { SmartAcmeLifecycle } from './acme/classes.smartacme-lifecycle.js';
 import { AcceptedEmailSpool, EmailDomainManager, EmailRouteBuilder, EmailSettingsManager, SmartMtaStorageManager, WorkAppMailManager, type TSmartMtaQueueItemLike } from './email/index.js';
 import type { IRoute } from '../ts_interfaces/data/route-management.js';
-import type { IEmailPortConfig, IEmailServerSettings, IEmailServerSettingsSeed, TEmailServerSettingsUpdate } from '../ts_interfaces/data/email-settings.js';
+import type { IEmailPortConfig, IEmailServerSettings, IEmailServerSettingsSeed, TEmailOutboundMode, TEmailServerSettingsUpdate } from '../ts_interfaces/data/email-settings.js';
 import type { IDcRouterRouteConfig, IRemoteIngressHubSettings, IRemoteIngressPerformanceConfig, TRemoteIngressHubSettingsUpdate } from '../ts_interfaces/data/remoteingress.js';
 import type { ISecurityCompiledPolicy } from '../ts_interfaces/data/security-policy.js';
 
@@ -55,20 +57,23 @@ export interface IDcRouterOptions {
 
   /** Legacy name for coreTrafficConfig. */
   smartProxyConfig?: plugins.smartproxy.ISmartProxyOptions;
-  
+
   /**
    * Email server configuration
    * This enables all email handling with pattern-based routing
    */
   emailConfig?: IUnifiedEmailServerOptions;
-  
+
+  /** Outbound SMTP connection mode. Defaults to direct unless DB settings override it. */
+  emailOutboundMode?: TEmailOutboundMode;
+
   /**
    * Custom email port configuration
    * Allows configuring specific ports for email handling
    * This overrides the default port mapping in the emailConfig
    */
   emailPortConfig?: IEmailPortConfig;
-  
+
   /** TLS/certificate configuration */
   tls?: {
     /** Contact email for ACME certificates */
@@ -841,6 +846,9 @@ export class DcRouter {
       seed.enabled = true;
       seed.emailConfig = JSON.parse(JSON.stringify(this.options.emailConfig));
     }
+    if (this.options.emailOutboundMode) {
+      seed.outboundMode = this.options.emailOutboundMode;
+    }
     if (this.options.emailPortConfig) {
       seed.emailPortConfig = JSON.parse(JSON.stringify(this.options.emailPortConfig));
     }
@@ -1591,6 +1599,9 @@ export class DcRouter {
     // Create config with mapped ports
     const baseEmailConfig = this.options.emailConfig;
     const configuredMessageDataHook = baseEmailConfig.hooks?.onMessageData;
+    const outboundMode = this.emailSettingsManager?.getOutboundMode()
+      || this.options.emailOutboundMode
+      || 'direct';
     const mappedEmailPorts = baseEmailConfig.ports.map(port => portMapping[port] || port + 10000);
     const configuredSecurePort = baseEmailConfig.smtp?.securePort;
     const mappedSecurePort = configuredSecurePort === undefined
@@ -1606,6 +1617,12 @@ export class DcRouter {
         ...this.options.emailConfig.queue,
         storageType: 'memory',
       },
+      outbound: {
+        ...baseEmailConfig.outbound,
+        ...(outboundMode === 'remoteIngress'
+          ? { connectionProxyProvider: async (context) => this.createRemoteIngressEmailConnectionProxy(context) }
+          : {}),
+      },
       smtp: {
         ...baseEmailConfig.smtp,
         ...(mappedSecurePort !== undefined
@@ -1755,6 +1772,41 @@ export class DcRouter {
     logger.log('info', `Email server started on ports: ${emailConfig.ports.join(', ')}`);
   }
 
+  private async createRemoteIngressEmailConnectionProxy(
+    context: IOutboundConnectionProxyContext,
+  ): Promise<IOutboundConnectionProxy> {
+    const tunnelManager = this.tunnelManager;
+    if (!tunnelManager) {
+      throw new Error('RemoteIngress outbound SMTP egress is enabled, but the hub is not running');
+    }
+
+    const connectionTimeoutMs = this.options.emailConfig?.outbound?.connectionTimeout ?? 30_000;
+    const proxy = await tunnelManager.startEgressTcpProxy({
+      logicalHost: context.host,
+      port: context.port,
+      serverFirst: !context.secure,
+      connectTimeoutMs: connectionTimeoutMs,
+      acceptTimeoutMs: connectionTimeoutMs,
+    });
+    let closed = false;
+    return {
+      connectHost: proxy.listenHost,
+      connectPort: proxy.listenPort,
+      poolKey: `remoteIngress:${proxy.edgeId}:${context.host}:${context.port}`,
+      close: async () => {
+        if (closed) {
+          return;
+        }
+        closed = true;
+        try {
+          await tunnelManager.stopEgressTcpProxy(proxy.proxyId);
+        } catch (err: unknown) {
+          logger.log('warn', `Failed to stop RemoteIngress egress proxy ${proxy.proxyId}: ${(err as Error).message}`);
+        }
+      },
+    };
+  }
+
   
   /**
    * Update the unified email configuration

package/ts/db/documents/classes.email-server-settings.doc.ts

@@ -1,7 +1,7 @@
 import type { IUnifiedEmailServerOptions } from '@push.rocks/smartmta';
 import * as plugins from '../../plugins.js';
 import { DcRouterDb } from '../classes.dcrouter-db.js';
-import type { IEmailPortConfig } from '../../../ts_interfaces/data/email-settings.js';
+import type { IEmailPortConfig, TEmailOutboundMode } from '../../../ts_interfaces/data/email-settings.js';
 
 const getDb = () => DcRouterDb.getInstance().getDb();
 
@@ -17,6 +17,9 @@ export class EmailServerSettingsDoc extends plugins.smartdata.SmartDataDbDoc<Ema
   @plugins.smartdata.svDb()
   public emailConfig?: IUnifiedEmailServerOptions;
 
+  @plugins.smartdata.svDb()
+  public outboundMode: TEmailOutboundMode = 'direct';
+
   @plugins.smartdata.svDb()
   public emailPortConfig?: IEmailPortConfig;
 

package/ts/db/documents/classes.remote-ingress-edge.doc.ts

@@ -1,6 +1,6 @@
 import * as plugins from '../../plugins.js';
 import { DcRouterDb } from '../classes.dcrouter-db.js';
-import type { IRemoteIngressPerformanceConfig } from '../../../ts_interfaces/data/remoteingress.js';
+import type { IRemoteIngressEgressPolicyConfig, IRemoteIngressPerformanceConfig } from '../../../ts_interfaces/data/remoteingress.js';
 
 const getDb = () => DcRouterDb.getInstance().getDb();
 
@@ -31,6 +31,9 @@ export class RemoteIngressEdgeDoc extends plugins.smartdata.SmartDataDbDoc<Remot
   @plugins.smartdata.svDb()
   public performance?: IRemoteIngressPerformanceConfig;
 
+  @plugins.smartdata.svDb()
+  public egress?: IRemoteIngressEgressPolicyConfig;
+
   @plugins.smartdata.svDb()
   public tags!: string[];
 

package/ts/email/classes.email-settings.manager.ts

@@ -4,6 +4,7 @@ import type { IDcRouterOptions } from '../classes.dcrouter.js';
 import type {
   IEmailPortConfig,
   IEmailServerSettings,
+  TEmailOutboundMode,
   TEmailServerSettingsUpdate,
 } from '../../ts_interfaces/data/email-settings.js';
 
@@ -21,6 +22,7 @@ function hasOwn(objectArg: object, keyArg: string): boolean {
 export class EmailSettingsManager {
   private cachedEmailConfig?: IUnifiedEmailServerOptions;
   private cachedEmailPortConfig?: IEmailPortConfig;
+  private outboundMode: TEmailOutboundMode = 'direct';
   private enabled = false;
   private updatedAt = 0;
   private updatedBy = 'default';
@@ -61,12 +63,17 @@ export class EmailSettingsManager {
     return this.isEnabled() ? clonePlain(this.cachedEmailPortConfig) : undefined;
   }
 
+  public getOutboundMode(): TEmailOutboundMode {
+    return this.outboundMode;
+  }
+
   public getPublicSettings(): IEmailServerSettings {
     const emailConfig = this.cachedEmailConfig;
     const emailPortConfig = this.cachedEmailPortConfig;
     return {
       enabled: this.isEnabled(),
       hostname: emailConfig?.hostname || null,
+      outboundMode: this.outboundMode,
       ports: [...(emailConfig?.ports || [])],
       portMapping: emailPortConfig?.portMapping ? { ...emailPortConfig.portMapping } : null,
       receivedEmailsPath: emailPortConfig?.receivedEmailsPath || null,
@@ -92,10 +99,12 @@ export class EmailSettingsManager {
     const nextEnabled = hasOwn(updates, 'enabled') ? Boolean(updates.enabled) : doc.enabled;
     const nextEmailConfig = this.patchEmailConfig(doc.emailConfig, updates, nextEnabled);
     const nextEmailPortConfig = this.patchEmailPortConfig(doc.emailPortConfig, updates);
+    const nextOutboundMode = this.patchOutboundMode(doc.outboundMode, updates);
 
     doc.enabled = nextEnabled;
     doc.emailConfig = nextEmailConfig;
     doc.emailPortConfig = nextEmailPortConfig;
+    doc.outboundMode = nextOutboundMode;
     doc.updatedAt = Date.now();
     doc.updatedBy = updatedBy;
     await doc.save();
@@ -109,6 +118,7 @@ export class EmailSettingsManager {
     this.enabled = doc.enabled;
     this.cachedEmailConfig = clonePlain(doc.emailConfig);
     this.cachedEmailPortConfig = clonePlain(doc.emailPortConfig);
+    this.outboundMode = this.normalizeOutboundMode(doc.outboundMode);
     this.updatedAt = doc.updatedAt;
     this.updatedBy = doc.updatedBy;
   }
@@ -116,6 +126,25 @@ export class EmailSettingsManager {
   private applyToRuntimeOptions(): void {
     this.options.emailConfig = this.getEmailConfig();
     this.options.emailPortConfig = this.getEmailPortConfig();
+    this.options.emailOutboundMode = this.outboundMode;
+  }
+
+  private patchOutboundMode(
+    existingMode: TEmailOutboundMode | undefined,
+    updates: TEmailServerSettingsUpdate,
+  ): TEmailOutboundMode {
+    if (hasOwn(updates, 'outboundMode') && updates.outboundMode !== undefined) {
+      return this.normalizeOutboundMode(updates.outboundMode);
+    }
+    return this.normalizeOutboundMode(existingMode);
+  }
+
+  private normalizeOutboundMode(mode: TEmailOutboundMode | undefined): TEmailOutboundMode {
+    if (!mode) return 'direct';
+    if (mode !== 'direct' && mode !== 'remoteIngress') {
+      throw new Error('Invalid email outbound mode');
+    }
+    return mode;
   }
 
   private patchEmailConfig(

package/ts/opsserver/handlers/config.handler.ts

@@ -107,6 +107,7 @@ export class ConfigHandler {
       ports: emailSettings?.ports || opts.emailConfig?.ports || [],
       portMapping,
       hostname: emailSettings?.hostname || opts.emailConfig?.hostname || null,
+      outboundMode: emailSettings?.outboundMode || opts.emailOutboundMode || 'direct',
       domains: emailDomains,
       emailRouteCount: emailSettings?.routeCount ?? opts.emailConfig?.routes?.length ?? 0,
       receivedEmailsPath: emailSettings?.receivedEmailsPath || opts.emailPortConfig?.receivedEmailsPath || null,

package/ts/opsserver/handlers/email-settings.handler.ts

@@ -58,6 +58,7 @@ export class EmailSettingsHandler {
     return {
       enabled: Boolean(emailConfig),
       hostname: emailConfig?.hostname || null,
+      outboundMode: this.opsServerRef.dcRouterRef.options.emailOutboundMode || 'direct',
       ports: [...(emailConfig?.ports || [])],
       portMapping: emailPortConfig?.portMapping ? { ...emailPortConfig.portMapping } : null,
       receivedEmailsPath: emailPortConfig?.receivedEmailsPath || null,

package/ts/opsserver/handlers/remoteingress.handler.ts

@@ -63,6 +63,7 @@ export class RemoteIngressHandler {
               dataArg.tags,
               dataArg.autoDerivePorts ?? true,
               dataArg.performance,
+              dataArg.egress,
             ));
             return { success: true, edge };
           } catch (err: unknown) {
@@ -117,6 +118,7 @@ export class RemoteIngressHandler {
               autoDerivePorts: dataArg.autoDerivePorts,
               enabled: dataArg.enabled,
               performance: dataArg.performance,
+              egress: dataArg.egress,
               tags: dataArg.tags,
             });
 

package/ts/remoteingress/classes.remoteingress-manager.ts

@@ -1,5 +1,5 @@
 import * as plugins from '../plugins.js';
-import type { IDcRouterRouteConfig, IRemoteIngress, IRemoteIngressHubSettings, IRemoteIngressPerformanceConfig, TRemoteIngressHubSettingsUpdate, TRemoteIngressPerformanceProfile } from '../../ts_interfaces/data/remoteingress.js';
+import type { IDcRouterRouteConfig, IRemoteIngress, IRemoteIngressEgressPolicyConfig, IRemoteIngressHubSettings, IRemoteIngressPerformanceConfig, TRemoteIngressHubSettingsUpdate, TRemoteIngressPerformanceProfile } from '../../ts_interfaces/data/remoteingress.js';
 import { RemoteIngressEdgeDoc, RemoteIngressHubSettingsDoc } from '../db/index.js';
 
 export interface IRemoteIngressFirewallConfig {
@@ -30,6 +30,7 @@ const performanceIntegerMaxByField: Record<TPerformanceIntegerField, number> = {
 };
 
 const maxServerFirstPorts = 128;
+const maxRemoteIngressEgressListEntries = 128;
 const defaultTunnelPort = 8443;
 
 function hasOwn(objectArg: object, keyArg: string): boolean {
@@ -79,6 +80,7 @@ export class RemoteIngressManager {
         enabled: doc.enabled,
         autoDerivePorts: doc.autoDerivePorts,
         performance: doc.performance,
+        egress: this.normalizeEgressPolicy(doc.egress),
         tags: doc.tags,
         createdAt: doc.createdAt,
         updatedAt: doc.updatedAt,
@@ -274,6 +276,7 @@ export class RemoteIngressManager {
     tags?: string[],
     autoDerivePorts: boolean = true,
     performance?: IRemoteIngressPerformanceConfig,
+    egress?: IRemoteIngressEgressPolicyConfig,
   ): Promise<IRemoteIngress> {
     const id = plugins.uuid.v4();
     const secret = plugins.crypto.randomBytes(32).toString('hex');
@@ -287,6 +290,7 @@ export class RemoteIngressManager {
       enabled: true,
       autoDerivePorts,
       performance,
+      egress: this.normalizeEgressPolicy(egress),
       tags: tags || [],
       createdAt: now,
       updatedAt: now,
@@ -324,6 +328,7 @@ export class RemoteIngressManager {
       autoDerivePorts?: boolean;
       enabled?: boolean;
       performance?: IRemoteIngressPerformanceConfig;
+      egress?: IRemoteIngressEgressPolicyConfig;
       tags?: string[];
     },
   ): Promise<IRemoteIngress | null> {
@@ -337,6 +342,7 @@ export class RemoteIngressManager {
     if (updates.autoDerivePorts !== undefined) edge.autoDerivePorts = updates.autoDerivePorts;
     if (updates.enabled !== undefined) edge.enabled = updates.enabled;
     if (updates.performance !== undefined) edge.performance = updates.performance;
+    if (updates.egress !== undefined) edge.egress = this.normalizeEgressPolicy(updates.egress);
     if (updates.tags !== undefined) edge.tags = updates.tags;
     edge.updatedAt = Date.now();
 
@@ -405,12 +411,13 @@ export class RemoteIngressManager {
    * Get the list of allowed edges (enabled only) for the Rust hub.
    * Includes listenPortsUdp when routes with transport 'udp' or 'all' are present.
    */
-  public getAllowedEdges(): Array<{ id: string; secret: string; listenPorts: number[]; listenPortsUdp?: number[]; firewallConfig?: IRemoteIngressFirewallConfig; performance?: IRemoteIngressPerformanceConfig }> {
-    const result: Array<{ id: string; secret: string; listenPorts: number[]; listenPortsUdp?: number[]; firewallConfig?: IRemoteIngressFirewallConfig; performance?: IRemoteIngressPerformanceConfig }> = [];
+  public getAllowedEdges(): Array<{ id: string; secret: string; listenPorts: number[]; listenPortsUdp?: number[]; firewallConfig?: IRemoteIngressFirewallConfig; performance?: IRemoteIngressPerformanceConfig; egress?: IRemoteIngressEgressPolicyConfig }> {
+    const result: Array<{ id: string; secret: string; listenPorts: number[]; listenPortsUdp?: number[]; firewallConfig?: IRemoteIngressFirewallConfig; performance?: IRemoteIngressPerformanceConfig; egress?: IRemoteIngressEgressPolicyConfig }> = [];
     for (const edge of this.edges.values()) {
       if (edge.enabled) {
         const listenPortsUdp = this.getEffectiveListenPortsUdp(edge);
         const performance = edge.performance && Object.keys(edge.performance).length > 0 ? edge.performance : undefined;
+        const egress = edge.egress?.enabled ? edge.egress : undefined;
         result.push({
           id: edge.id,
           secret: edge.secret,
@@ -418,12 +425,80 @@ export class RemoteIngressManager {
           ...(listenPortsUdp.length > 0 ? { listenPortsUdp } : {}),
           ...(this.firewallConfig ? { firewallConfig: this.firewallConfig } : {}),
           ...(performance ? { performance } : {}),
+          ...(egress ? { egress } : {}),
         });
       }
     }
     return result;
   }
 
+  private normalizeEgressPolicy(
+    egress?: IRemoteIngressEgressPolicyConfig,
+  ): IRemoteIngressEgressPolicyConfig | undefined {
+    if (!egress) {
+      return undefined;
+    }
+
+    const enabled = Boolean(egress.enabled);
+    const next: IRemoteIngressEgressPolicyConfig = { enabled };
+    if (!enabled) {
+      return next;
+    }
+
+    const allowedPorts = this.normalizeEgressAllowedPorts(egress.allowedPorts || [25]);
+    next.allowedPorts = allowedPorts;
+
+    if (egress.allowPrivateRanges !== undefined) {
+      next.allowPrivateRanges = Boolean(egress.allowPrivateRanges);
+    }
+
+    if (egress.deniedCidrs !== undefined) {
+      if (!Array.isArray(egress.deniedCidrs) || egress.deniedCidrs.length > maxRemoteIngressEgressListEntries) {
+        throw new Error(`RemoteIngress egress deniedCidrs must contain at most ${maxRemoteIngressEgressListEntries} entries`);
+      }
+      const deniedCidrs = [...new Set(egress.deniedCidrs.map((cidr) => `${cidr}`.trim()).filter(Boolean))];
+      if (deniedCidrs.length > 0) {
+        next.deniedCidrs = deniedCidrs;
+      }
+    }
+
+    if (egress.allowedHostPatterns !== undefined) {
+      if (!Array.isArray(egress.allowedHostPatterns) || egress.allowedHostPatterns.length > maxRemoteIngressEgressListEntries) {
+        throw new Error(`RemoteIngress egress allowedHostPatterns must contain at most ${maxRemoteIngressEgressListEntries} entries`);
+      }
+      const allowedHostPatterns = [...new Set(egress.allowedHostPatterns.map((pattern) => `${pattern}`.trim()).filter(Boolean))];
+      if (allowedHostPatterns.length > 0) {
+        next.allowedHostPatterns = allowedHostPatterns;
+      }
+    }
+
+    if (egress.maxConcurrentStreams !== undefined) {
+      const maxConcurrentStreams = Number(egress.maxConcurrentStreams);
+      if (!Number.isSafeInteger(maxConcurrentStreams) || maxConcurrentStreams < 1 || maxConcurrentStreams > 100_000) {
+        throw new Error('RemoteIngress egress maxConcurrentStreams must be a positive safe integer no greater than 100000');
+      }
+      next.maxConcurrentStreams = maxConcurrentStreams;
+    }
+
+    return next;
+  }
+
+  private normalizeEgressAllowedPorts(ports: number[]): number[] {
+    if (!Array.isArray(ports) || ports.length === 0 || ports.length > maxRemoteIngressEgressListEntries) {
+      throw new Error(`RemoteIngress egress allowedPorts must contain 1-${maxRemoteIngressEgressListEntries} ports`);
+    }
+    const allowedPorts = [...new Set(ports.map((port) => Number(port)))].sort((a, b) => a - b);
+    for (const port of allowedPorts) {
+      if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error('RemoteIngress egress allowedPorts must contain valid TCP ports');
+      }
+      if (port !== 25) {
+        throw new Error('RemoteIngress egress is currently limited to outbound SMTP port 25');
+      }
+    }
+    return allowedPorts;
+  }
+
   private normalizeHubSettingsUpdate(
     updates: TRemoteIngressHubSettingsUpdate,
   ): TRemoteIngressHubSettingsUpdate {

package/ts/remoteingress/classes.tunnel-manager.ts

@@ -12,6 +12,10 @@ export interface ITunnelManagerConfig {
   performance?: IRemoteIngressPerformanceConfig;
 }
 
+export type TRemoteIngressEgressProxyRequest = Omit<plugins.remoteingress.IEgressTcpProxyRequest, 'edgeId'> & {
+  edgeId?: string;
+};
+
 /**
  * Manages the RemoteIngressHub instance and tracks connected edge statuses.
  */
@@ -181,9 +185,51 @@ export class TunnelManager {
     await run;
   }
 
+  public async startEgressTcpProxy(
+    request: TRemoteIngressEgressProxyRequest,
+  ): Promise<plugins.remoteingress.IEgressTcpProxyInfo> {
+    if (this.stopped) {
+      throw new Error('RemoteIngress hub is not running');
+    }
+
+    const status = await this.hub.getStatus();
+    if (this.stopped) {
+      throw new Error('RemoteIngress hub is not running');
+    }
+    const connectedEdges = Array.isArray(status?.connectedEdges) ? status.connectedEdges : [];
+    const eligibleEdges = connectedEdges.filter((edge: any) => {
+      const hasEgressCapability = Array.isArray(edge.capabilities) && edge.capabilities.includes('egressTcpV1');
+      const usesQuic = edge.transportMode === 'quic'
+        || (edge.transportMode === 'quicWithFallback' && edge.fallbackUsed === false);
+      return edge.egressEnabled === true && hasEgressCapability && usesQuic;
+    });
+    const selectedEdge = request.edgeId
+      ? eligibleEdges.find((edge: any) => edge.edgeId === request.edgeId)
+      : eligibleEdges[0];
+
+    if (!selectedEdge) {
+      const edgeHint = request.edgeId ? ` for edge ${request.edgeId}` : '';
+      throw new Error(`No eligible RemoteIngress QUIC egress edge is connected${edgeHint}`);
+    }
+
+    return await this.hub.startEgressTcpProxy({
+      ...request,
+      edgeId: selectedEdge.edgeId,
+    });
+  }
+
+  public async stopEgressTcpProxy(proxyId: string): Promise<boolean> {
+    if (this.stopped) {
+      return false;
+    }
+    return await this.hub.stopEgressTcpProxy(proxyId);
+  }
+
   private applyRustStatus(status: IRemoteIngressStatus, rustEdge: any): void {
     status.transportMode = rustEdge.transportMode;
     status.fallbackUsed = rustEdge.fallbackUsed;
+    status.capabilities = rustEdge.capabilities;
+    status.egressEnabled = rustEdge.egressEnabled;
     status.performance = rustEdge.performance;
     status.flowControl = rustEdge.flowControl;
     status.queues = rustEdge.queues;

package/ts_apiclient/classes.remoteingress.ts

@@ -19,6 +19,8 @@ export class RemoteIngress {
   public effectiveListenPortsUdp?: number[];
   public manualPorts?: number[];
   public derivedPorts?: number[];
+  public performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+  public egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
 
   constructor(clientRef: DcRouterApiClient, data: interfaces.data.IRemoteIngress) {
     this.clientRef = clientRef;
@@ -36,6 +38,8 @@ export class RemoteIngress {
     this.effectiveListenPortsUdp = data.effectiveListenPortsUdp;
     this.manualPorts = data.manualPorts;
     this.derivedPorts = data.derivedPorts;
+    this.performance = data.performance;
+    this.egress = data.egress;
   }
 
   public async update(changes: {
@@ -44,6 +48,8 @@ export class RemoteIngress {
     autoDerivePorts?: boolean;
     enabled?: boolean;
     tags?: string[];
+    performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+    egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
   }): Promise<void> {
     const response = await this.clientRef.request<interfaces.requests.IReq_UpdateRemoteIngress>(
       'updateRemoteIngress',
@@ -65,6 +71,8 @@ export class RemoteIngress {
     this.effectiveListenPortsUdp = edge.effectiveListenPortsUdp;
     this.manualPorts = edge.manualPorts;
     this.derivedPorts = edge.derivedPorts;
+    this.performance = edge.performance;
+    this.egress = edge.egress;
   }
 
   public async delete(): Promise<void> {
@@ -106,6 +114,8 @@ export class RemoteIngressBuilder {
   private edgeName: string = '';
   private edgeListenPorts?: number[];
   private edgeAutoDerivePorts?: boolean;
+  private edgePerformance?: interfaces.data.IRemoteIngressPerformanceConfig;
+  private edgeEgress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
   private edgeTags?: string[];
 
   constructor(clientRef: DcRouterApiClient) {
@@ -132,6 +142,16 @@ export class RemoteIngressBuilder {
     return this;
   }
 
+  public setPerformance(performance: interfaces.data.IRemoteIngressPerformanceConfig): this {
+    this.edgePerformance = performance;
+    return this;
+  }
+
+  public setEgress(egress: interfaces.data.IRemoteIngressEgressPolicyConfig): this {
+    this.edgeEgress = egress;
+    return this;
+  }
+
   public async save(): Promise<RemoteIngress> {
     const response = await this.clientRef.request<interfaces.requests.IReq_CreateRemoteIngress>(
       'createRemoteIngress',
@@ -139,6 +159,8 @@ export class RemoteIngressBuilder {
         name: this.edgeName,
         listenPorts: this.edgeListenPorts,
         autoDerivePorts: this.edgeAutoDerivePorts,
+        performance: this.edgePerformance,
+        egress: this.edgeEgress,
         tags: this.edgeTags,
       }) as any,
     );
@@ -176,11 +198,15 @@ export class RemoteIngressManager {
     name: string;
     listenPorts?: number[];
     autoDerivePorts?: boolean;
+    performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+    egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
     tags?: string[];
   }): Promise<RemoteIngress> {
     const builder = this.build().setName(options.name);
     if (options.listenPorts) builder.setListenPorts(options.listenPorts);
     if (options.autoDerivePorts !== undefined) builder.setAutoDerivePorts(options.autoDerivePorts);
+    if (options.performance) builder.setPerformance(options.performance);
+    if (options.egress) builder.setEgress(options.egress);
     if (options.tags) builder.setTags(options.tags);
     return builder.save();
   }

package/ts_apiclient/readme.md

@@ -113,6 +113,12 @@ const edge = await client.remoteIngress.build()
   .setName('edge-eu-1')
   .setListenPorts([80, 443])
   .setAutoDerivePorts(true)
+  .setEgress({
+    enabled: true,
+    allowedPorts: [25],
+    allowedHostPatterns: ['*.example.com'],
+    maxConcurrentStreams: 100,
+  })
   .setTags(['production', 'eu'])
   .save();
 
@@ -120,6 +126,8 @@ const connectionToken = await edge.getConnectionToken();
 console.log(token.tokenValue, connectionToken);
 ```
 
+RemoteIngress resources expose `performance` and `egress` fields. `create()` and `update()` accept the same fields as the builder. Egress is default-disabled; dcrouter currently accepts outbound SMTP egress on port `25` only.
+
 ## What This Package Is Not
 
 - It does not start dcrouter.

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '15.6.1',
+  version: '15.7.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts_web/appstate/remoteingress.ts

@@ -95,6 +95,7 @@ export const createRemoteIngressAction = remoteIngressStatePart.createAction<{
   listenPorts?: number[];
   autoDerivePorts?: boolean;
   performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+  egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
   tags?: string[];
 }>(async (statePartArg, dataArg, actionContext): Promise<IRemoteIngressState> => {
   const context = getActionContext();
@@ -111,6 +112,7 @@ export const createRemoteIngressAction = remoteIngressStatePart.createAction<{
       listenPorts: dataArg.listenPorts,
       autoDerivePorts: dataArg.autoDerivePorts,
       performance: dataArg.performance,
+      egress: dataArg.egress,
       tags: dataArg.tags,
     });
 
@@ -164,6 +166,7 @@ export const updateRemoteIngressAction = remoteIngressStatePart.createAction<{
   listenPorts?: number[];
   autoDerivePorts?: boolean;
   performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+  egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
   tags?: string[];
 }>(async (statePartArg, dataArg, actionContext): Promise<IRemoteIngressState> => {
   const context = getActionContext();
@@ -181,6 +184,7 @@ export const updateRemoteIngressAction = remoteIngressStatePart.createAction<{
       listenPorts: dataArg.listenPorts,
       autoDerivePorts: dataArg.autoDerivePorts,
       performance: dataArg.performance,
+      egress: dataArg.egress,
       tags: dataArg.tags,
     });
 

package/ts_web/elements/email/ops-view-email-domains.ts

@@ -330,6 +330,11 @@ export class OpsViewEmailDomains extends DeesElement {
             .description=${'Public hostname used in SMTP banners and DNS records'}
             .value=${settings?.hostname || ''}
           ></dees-input-text>
+          <dees-input-checkbox
+            .key=${'outboundRemoteIngress'}
+            .label=${'Route outbound SMTP through RemoteIngress'}
+            .value=${settings?.outboundMode === 'remoteIngress'}
+          ></dees-input-checkbox>
           <dees-input-text
             .key=${'ports'}
             .label=${'Public ports'}
@@ -370,6 +375,7 @@ export class OpsViewEmailDomains extends DeesElement {
               {
                 enabled: Boolean(data.enabled),
                 hostname: String(data.hostname || '').trim() || null,
+                outboundMode: Boolean(data.outboundRemoteIngress) ? 'remoteIngress' : 'direct',
                 ports: this.parsePortList(String(data.ports || '')),
                 portMapping: this.parsePortMapping(String(data.portMapping || '')),
                 maxMessageSize: maxMessageSizeRaw ? Number.parseInt(maxMessageSizeRaw, 10) : null,