@serve.zone/dcrouter 15.6.1 → 15.8.0

package/ts/opsserver/handlers/remoteingress.handler.ts

@@ -63,6 +63,7 @@ export class RemoteIngressHandler {
               dataArg.tags,
               dataArg.autoDerivePorts ?? true,
               dataArg.performance,
+              dataArg.egress,
             ));
             return { success: true, edge };
           } catch (err: unknown) {
@@ -117,6 +118,7 @@ export class RemoteIngressHandler {
               autoDerivePorts: dataArg.autoDerivePorts,
               enabled: dataArg.enabled,
               performance: dataArg.performance,
+              egress: dataArg.egress,
               tags: dataArg.tags,
             });
 

package/ts/remoteingress/classes.remoteingress-manager.ts

@@ -1,5 +1,5 @@
 import * as plugins from '../plugins.js';
-import type { IDcRouterRouteConfig, IRemoteIngress, IRemoteIngressHubSettings, IRemoteIngressPerformanceConfig, TRemoteIngressHubSettingsUpdate, TRemoteIngressPerformanceProfile } from '../../ts_interfaces/data/remoteingress.js';
+import type { IDcRouterRouteConfig, IRemoteIngress, IRemoteIngressEgressPolicyConfig, IRemoteIngressHubSettings, IRemoteIngressPerformanceConfig, TRemoteIngressHubSettingsUpdate, TRemoteIngressPerformanceProfile } from '../../ts_interfaces/data/remoteingress.js';
 import { RemoteIngressEdgeDoc, RemoteIngressHubSettingsDoc } from '../db/index.js';
 
 export interface IRemoteIngressFirewallConfig {
@@ -30,6 +30,7 @@ const performanceIntegerMaxByField: Record<TPerformanceIntegerField, number> = {
 };
 
 const maxServerFirstPorts = 128;
+const maxRemoteIngressEgressListEntries = 128;
 const defaultTunnelPort = 8443;
 
 function hasOwn(objectArg: object, keyArg: string): boolean {
@@ -79,6 +80,7 @@ export class RemoteIngressManager {
         enabled: doc.enabled,
         autoDerivePorts: doc.autoDerivePorts,
         performance: doc.performance,
+        egress: this.normalizeEgressPolicy(doc.egress),
         tags: doc.tags,
         createdAt: doc.createdAt,
         updatedAt: doc.updatedAt,
@@ -274,6 +276,7 @@ export class RemoteIngressManager {
     tags?: string[],
     autoDerivePorts: boolean = true,
     performance?: IRemoteIngressPerformanceConfig,
+    egress?: IRemoteIngressEgressPolicyConfig,
   ): Promise<IRemoteIngress> {
     const id = plugins.uuid.v4();
     const secret = plugins.crypto.randomBytes(32).toString('hex');
@@ -287,6 +290,7 @@ export class RemoteIngressManager {
       enabled: true,
       autoDerivePorts,
       performance,
+      egress: this.normalizeEgressPolicy(egress),
       tags: tags || [],
       createdAt: now,
       updatedAt: now,
@@ -324,6 +328,7 @@ export class RemoteIngressManager {
       autoDerivePorts?: boolean;
       enabled?: boolean;
       performance?: IRemoteIngressPerformanceConfig;
+      egress?: IRemoteIngressEgressPolicyConfig;
       tags?: string[];
     },
   ): Promise<IRemoteIngress | null> {
@@ -337,6 +342,7 @@ export class RemoteIngressManager {
     if (updates.autoDerivePorts !== undefined) edge.autoDerivePorts = updates.autoDerivePorts;
     if (updates.enabled !== undefined) edge.enabled = updates.enabled;
     if (updates.performance !== undefined) edge.performance = updates.performance;
+    if (updates.egress !== undefined) edge.egress = this.normalizeEgressPolicy(updates.egress);
     if (updates.tags !== undefined) edge.tags = updates.tags;
     edge.updatedAt = Date.now();
 
@@ -405,12 +411,13 @@ export class RemoteIngressManager {
    * Get the list of allowed edges (enabled only) for the Rust hub.
    * Includes listenPortsUdp when routes with transport 'udp' or 'all' are present.
    */
-  public getAllowedEdges(): Array<{ id: string; secret: string; listenPorts: number[]; listenPortsUdp?: number[]; firewallConfig?: IRemoteIngressFirewallConfig; performance?: IRemoteIngressPerformanceConfig }> {
-    const result: Array<{ id: string; secret: string; listenPorts: number[]; listenPortsUdp?: number[]; firewallConfig?: IRemoteIngressFirewallConfig; performance?: IRemoteIngressPerformanceConfig }> = [];
+  public getAllowedEdges(): Array<{ id: string; secret: string; listenPorts: number[]; listenPortsUdp?: number[]; firewallConfig?: IRemoteIngressFirewallConfig; performance?: IRemoteIngressPerformanceConfig; egress?: IRemoteIngressEgressPolicyConfig }> {
+    const result: Array<{ id: string; secret: string; listenPorts: number[]; listenPortsUdp?: number[]; firewallConfig?: IRemoteIngressFirewallConfig; performance?: IRemoteIngressPerformanceConfig; egress?: IRemoteIngressEgressPolicyConfig }> = [];
     for (const edge of this.edges.values()) {
       if (edge.enabled) {
         const listenPortsUdp = this.getEffectiveListenPortsUdp(edge);
         const performance = edge.performance && Object.keys(edge.performance).length > 0 ? edge.performance : undefined;
+        const egress = edge.egress?.enabled ? edge.egress : undefined;
         result.push({
           id: edge.id,
           secret: edge.secret,
@@ -418,12 +425,80 @@ export class RemoteIngressManager {
           ...(listenPortsUdp.length > 0 ? { listenPortsUdp } : {}),
           ...(this.firewallConfig ? { firewallConfig: this.firewallConfig } : {}),
           ...(performance ? { performance } : {}),
+          ...(egress ? { egress } : {}),
         });
       }
     }
     return result;
   }
 
+  private normalizeEgressPolicy(
+    egress?: IRemoteIngressEgressPolicyConfig,
+  ): IRemoteIngressEgressPolicyConfig | undefined {
+    if (!egress) {
+      return undefined;
+    }
+
+    const enabled = Boolean(egress.enabled);
+    const next: IRemoteIngressEgressPolicyConfig = { enabled };
+    if (!enabled) {
+      return next;
+    }
+
+    const allowedPorts = this.normalizeEgressAllowedPorts(egress.allowedPorts || [25]);
+    next.allowedPorts = allowedPorts;
+
+    if (egress.allowPrivateRanges !== undefined) {
+      next.allowPrivateRanges = Boolean(egress.allowPrivateRanges);
+    }
+
+    if (egress.deniedCidrs !== undefined) {
+      if (!Array.isArray(egress.deniedCidrs) || egress.deniedCidrs.length > maxRemoteIngressEgressListEntries) {
+        throw new Error(`RemoteIngress egress deniedCidrs must contain at most ${maxRemoteIngressEgressListEntries} entries`);
+      }
+      const deniedCidrs = [...new Set(egress.deniedCidrs.map((cidr) => `${cidr}`.trim()).filter(Boolean))];
+      if (deniedCidrs.length > 0) {
+        next.deniedCidrs = deniedCidrs;
+      }
+    }
+
+    if (egress.allowedHostPatterns !== undefined) {
+      if (!Array.isArray(egress.allowedHostPatterns) || egress.allowedHostPatterns.length > maxRemoteIngressEgressListEntries) {
+        throw new Error(`RemoteIngress egress allowedHostPatterns must contain at most ${maxRemoteIngressEgressListEntries} entries`);
+      }
+      const allowedHostPatterns = [...new Set(egress.allowedHostPatterns.map((pattern) => `${pattern}`.trim()).filter(Boolean))];
+      if (allowedHostPatterns.length > 0) {
+        next.allowedHostPatterns = allowedHostPatterns;
+      }
+    }
+
+    if (egress.maxConcurrentStreams !== undefined) {
+      const maxConcurrentStreams = Number(egress.maxConcurrentStreams);
+      if (!Number.isSafeInteger(maxConcurrentStreams) || maxConcurrentStreams < 1 || maxConcurrentStreams > 100_000) {
+        throw new Error('RemoteIngress egress maxConcurrentStreams must be a positive safe integer no greater than 100000');
+      }
+      next.maxConcurrentStreams = maxConcurrentStreams;
+    }
+
+    return next;
+  }
+
+  private normalizeEgressAllowedPorts(ports: number[]): number[] {
+    if (!Array.isArray(ports) || ports.length === 0 || ports.length > maxRemoteIngressEgressListEntries) {
+      throw new Error(`RemoteIngress egress allowedPorts must contain 1-${maxRemoteIngressEgressListEntries} ports`);
+    }
+    const allowedPorts = [...new Set(ports.map((port) => Number(port)))].sort((a, b) => a - b);
+    for (const port of allowedPorts) {
+      if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error('RemoteIngress egress allowedPorts must contain valid TCP ports');
+      }
+      if (port !== 25) {
+        throw new Error('RemoteIngress egress is currently limited to outbound SMTP port 25');
+      }
+    }
+    return allowedPorts;
+  }
+
   private normalizeHubSettingsUpdate(
     updates: TRemoteIngressHubSettingsUpdate,
   ): TRemoteIngressHubSettingsUpdate {

package/ts/remoteingress/classes.tunnel-manager.ts

@@ -1,4 +1,5 @@
 import * as plugins from '../plugins.js';
+import { logger } from '../logger.js';
 import type { IRemoteIngressPerformanceConfig, IRemoteIngressStatus } from '../../ts_interfaces/data/remoteingress.js';
 import type { RemoteIngressManager } from './classes.remoteingress-manager.js';
 
@@ -12,6 +13,10 @@ export interface ITunnelManagerConfig {
   performance?: IRemoteIngressPerformanceConfig;
 }
 
+export type TRemoteIngressEgressProxyRequest = Omit<plugins.remoteingress.IEgressTcpProxyRequest, 'edgeId'> & {
+  edgeId?: string;
+};
+
 /**
  * Manages the RemoteIngressHub instance and tracks connected edge statuses.
  */
@@ -62,6 +67,20 @@ export class TunnelManager {
         }
       }
     });
+
+    this.hub.on('egressConnection', (data: {
+      proxyId: string;
+      edgeId: string;
+      logicalHost: string;
+      port: number;
+      outcome: string;
+      resolvedIp?: string;
+      error?: string;
+    }) => {
+      const message = `RemoteIngress egress ${data.outcome}: edge=${data.edgeId} proxy=${data.proxyId} target=${data.logicalHost}:${data.port}${data.resolvedIp ? ` resolvedIp=${data.resolvedIp}` : ''}${data.error ? ` error=${data.error}` : ''}`;
+      const isExpectedLifecycleEvent = data.outcome === 'connected' || data.outcome === 'closed';
+      logger.log(isExpectedLifecycleEvent ? 'info' : 'warn', message);
+    });
   }
 
   /**
@@ -181,9 +200,51 @@ export class TunnelManager {
     await run;
   }
 
+  public async startEgressTcpProxy(
+    request: TRemoteIngressEgressProxyRequest,
+  ): Promise<plugins.remoteingress.IEgressTcpProxyInfo> {
+    if (this.stopped) {
+      throw new Error('RemoteIngress hub is not running');
+    }
+
+    const status = await this.hub.getStatus();
+    if (this.stopped) {
+      throw new Error('RemoteIngress hub is not running');
+    }
+    const connectedEdges = Array.isArray(status?.connectedEdges) ? status.connectedEdges : [];
+    const eligibleEdges = connectedEdges.filter((edge: any) => {
+      const hasEgressCapability = Array.isArray(edge.capabilities) && edge.capabilities.includes('egressTcpV1');
+      const usesQuic = edge.transportMode === 'quic'
+        || (edge.transportMode === 'quicWithFallback' && edge.fallbackUsed === false);
+      return edge.egressEnabled === true && hasEgressCapability && usesQuic;
+    });
+    const selectedEdge = request.edgeId
+      ? eligibleEdges.find((edge: any) => edge.edgeId === request.edgeId)
+      : eligibleEdges[0];
+
+    if (!selectedEdge) {
+      const edgeHint = request.edgeId ? ` for edge ${request.edgeId}` : '';
+      throw new Error(`No eligible RemoteIngress QUIC egress edge is connected${edgeHint}`);
+    }
+
+    return await this.hub.startEgressTcpProxy({
+      ...request,
+      edgeId: selectedEdge.edgeId,
+    });
+  }
+
+  public async stopEgressTcpProxy(proxyId: string): Promise<boolean> {
+    if (this.stopped) {
+      return false;
+    }
+    return await this.hub.stopEgressTcpProxy(proxyId);
+  }
+
   private applyRustStatus(status: IRemoteIngressStatus, rustEdge: any): void {
     status.transportMode = rustEdge.transportMode;
     status.fallbackUsed = rustEdge.fallbackUsed;
+    status.capabilities = rustEdge.capabilities;
+    status.egressEnabled = rustEdge.egressEnabled;
     status.performance = rustEdge.performance;
     status.flowControl = rustEdge.flowControl;
     status.queues = rustEdge.queues;

package/ts_apiclient/classes.remoteingress.ts

@@ -19,6 +19,8 @@ export class RemoteIngress {
   public effectiveListenPortsUdp?: number[];
   public manualPorts?: number[];
   public derivedPorts?: number[];
+  public performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+  public egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
 
   constructor(clientRef: DcRouterApiClient, data: interfaces.data.IRemoteIngress) {
     this.clientRef = clientRef;
@@ -36,6 +38,8 @@ export class RemoteIngress {
     this.effectiveListenPortsUdp = data.effectiveListenPortsUdp;
     this.manualPorts = data.manualPorts;
     this.derivedPorts = data.derivedPorts;
+    this.performance = data.performance;
+    this.egress = data.egress;
   }
 
   public async update(changes: {
@@ -44,6 +48,8 @@ export class RemoteIngress {
     autoDerivePorts?: boolean;
     enabled?: boolean;
     tags?: string[];
+    performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+    egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
   }): Promise<void> {
     const response = await this.clientRef.request<interfaces.requests.IReq_UpdateRemoteIngress>(
       'updateRemoteIngress',
@@ -65,6 +71,8 @@ export class RemoteIngress {
     this.effectiveListenPortsUdp = edge.effectiveListenPortsUdp;
     this.manualPorts = edge.manualPorts;
     this.derivedPorts = edge.derivedPorts;
+    this.performance = edge.performance;
+    this.egress = edge.egress;
   }
 
   public async delete(): Promise<void> {
@@ -106,6 +114,8 @@ export class RemoteIngressBuilder {
   private edgeName: string = '';
   private edgeListenPorts?: number[];
   private edgeAutoDerivePorts?: boolean;
+  private edgePerformance?: interfaces.data.IRemoteIngressPerformanceConfig;
+  private edgeEgress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
   private edgeTags?: string[];
 
   constructor(clientRef: DcRouterApiClient) {
@@ -132,6 +142,16 @@ export class RemoteIngressBuilder {
     return this;
   }
 
+  public setPerformance(performance: interfaces.data.IRemoteIngressPerformanceConfig): this {
+    this.edgePerformance = performance;
+    return this;
+  }
+
+  public setEgress(egress: interfaces.data.IRemoteIngressEgressPolicyConfig): this {
+    this.edgeEgress = egress;
+    return this;
+  }
+
   public async save(): Promise<RemoteIngress> {
     const response = await this.clientRef.request<interfaces.requests.IReq_CreateRemoteIngress>(
       'createRemoteIngress',
@@ -139,6 +159,8 @@ export class RemoteIngressBuilder {
         name: this.edgeName,
         listenPorts: this.edgeListenPorts,
         autoDerivePorts: this.edgeAutoDerivePorts,
+        performance: this.edgePerformance,
+        egress: this.edgeEgress,
         tags: this.edgeTags,
       }) as any,
     );
@@ -176,11 +198,15 @@ export class RemoteIngressManager {
     name: string;
     listenPorts?: number[];
     autoDerivePorts?: boolean;
+    performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+    egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
     tags?: string[];
   }): Promise<RemoteIngress> {
     const builder = this.build().setName(options.name);
     if (options.listenPorts) builder.setListenPorts(options.listenPorts);
     if (options.autoDerivePorts !== undefined) builder.setAutoDerivePorts(options.autoDerivePorts);
+    if (options.performance) builder.setPerformance(options.performance);
+    if (options.egress) builder.setEgress(options.egress);
     if (options.tags) builder.setTags(options.tags);
     return builder.save();
   }

package/ts_apiclient/readme.md

@@ -113,6 +113,12 @@ const edge = await client.remoteIngress.build()
   .setName('edge-eu-1')
   .setListenPorts([80, 443])
   .setAutoDerivePorts(true)
+  .setEgress({
+    enabled: true,
+    allowedPorts: [25],
+    allowedHostPatterns: ['*.example.com'],
+    maxConcurrentStreams: 100,
+  })
   .setTags(['production', 'eu'])
   .save();
 
@@ -120,6 +126,8 @@ const connectionToken = await edge.getConnectionToken();
 console.log(token.tokenValue, connectionToken);
 ```
 
+RemoteIngress resources expose `performance` and `egress` fields. `create()` and `update()` accept the same fields as the builder. Egress is default-disabled; dcrouter currently accepts outbound SMTP egress on port `25` only.
+
 ## What This Package Is Not
 
 - It does not start dcrouter.

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '15.6.1',
+  version: '15.8.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts_web/appstate/remoteingress.ts

@@ -95,6 +95,7 @@ export const createRemoteIngressAction = remoteIngressStatePart.createAction<{
   listenPorts?: number[];
   autoDerivePorts?: boolean;
   performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+  egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
   tags?: string[];
 }>(async (statePartArg, dataArg, actionContext): Promise<IRemoteIngressState> => {
   const context = getActionContext();
@@ -111,6 +112,7 @@ export const createRemoteIngressAction = remoteIngressStatePart.createAction<{
       listenPorts: dataArg.listenPorts,
       autoDerivePorts: dataArg.autoDerivePorts,
       performance: dataArg.performance,
+      egress: dataArg.egress,
       tags: dataArg.tags,
     });
 
@@ -164,6 +166,7 @@ export const updateRemoteIngressAction = remoteIngressStatePart.createAction<{
   listenPorts?: number[];
   autoDerivePorts?: boolean;
   performance?: interfaces.data.IRemoteIngressPerformanceConfig;
+  egress?: interfaces.data.IRemoteIngressEgressPolicyConfig;
   tags?: string[];
 }>(async (statePartArg, dataArg, actionContext): Promise<IRemoteIngressState> => {
   const context = getActionContext();
@@ -181,6 +184,7 @@ export const updateRemoteIngressAction = remoteIngressStatePart.createAction<{
       listenPorts: dataArg.listenPorts,
       autoDerivePorts: dataArg.autoDerivePorts,
       performance: dataArg.performance,
+      egress: dataArg.egress,
       tags: dataArg.tags,
     });
 

package/ts_web/elements/email/ops-view-email-domains.ts

@@ -330,6 +330,11 @@ export class OpsViewEmailDomains extends DeesElement {
             .description=${'Public hostname used in SMTP banners and DNS records'}
             .value=${settings?.hostname || ''}
           ></dees-input-text>
+          <dees-input-checkbox
+            .key=${'outboundRemoteIngress'}
+            .label=${'Route outbound SMTP through RemoteIngress'}
+            .value=${settings?.outboundMode === 'remoteIngress'}
+          ></dees-input-checkbox>
           <dees-input-text
             .key=${'ports'}
             .label=${'Public ports'}
@@ -370,6 +375,7 @@ export class OpsViewEmailDomains extends DeesElement {
               {
                 enabled: Boolean(data.enabled),
                 hostname: String(data.hostname || '').trim() || null,
+                outboundMode: Boolean(data.outboundRemoteIngress) ? 'remoteIngress' : 'direct',
                 ports: this.parsePortList(String(data.ports || '')),
                 portMapping: this.parsePortMapping(String(data.portMapping || '')),
                 maxMessageSize: maxMessageSizeRaw ? Number.parseInt(maxMessageSizeRaw, 10) : null,

package/ts_web/elements/network/ops-view-remoteingress.ts

@@ -259,6 +259,7 @@ export class OpsViewRemoteIngress extends DeesElement {
             transport: this.getTransportHtml(edge.id),
             publicIp: this.getEdgePublicIp(edge.id),
             ports: this.getPortsHtml(edge),
+            smtpEgress: this.getEgressHtml(edge),
             tunnels: this.getEdgeTunnelCount(edge.id),
             maxConnections: this.getMaxConnectionsHtml(edge),
             window: this.getWindowHtml(edge.id),
@@ -281,6 +282,9 @@ export class OpsViewRemoteIngress extends DeesElement {
                       <dees-input-text .key=${'listenPorts'} .label=${'Manual Ports'} .description=${'Comma-separated port numbers, optional'}></dees-input-text>
                       <dees-input-checkbox .key=${'autoDerivePorts'} .label=${'Auto-derive ports from routes'} .value=${true}></dees-input-checkbox>
                       <dees-input-text .key=${'maxStreamsPerEdge'} .label=${'Max Connections'} .description=${'Optional maximum concurrent client connections for this edge. Leave empty to use the hub default.'}></dees-input-text>
+                      <dees-input-checkbox .key=${'egressEnabled'} .label=${'Allow outbound SMTP egress'} .value=${false}></dees-input-checkbox>
+                      <dees-input-text .key=${'egressAllowedHostPatterns'} .label=${'SMTP Egress Host Patterns'} .description=${'Optional comma-separated MX host patterns. Leave empty to allow public MX hosts on port 25.'}></dees-input-text>
+                      <dees-input-text .key=${'egressMaxConcurrentStreams'} .label=${'SMTP Egress Max Streams'} .description=${'Optional concurrent outbound SMTP stream cap for this edge.'}></dees-input-text>
                       <dees-input-text .key=${'tags'} .label=${'Tags'} .description=${'Comma-separated, optional'}></dees-input-text>
                     </dees-form>
                   `,
@@ -305,8 +309,10 @@ export class OpsViewRemoteIngress extends DeesElement {
                           : undefined;
                         const autoDerivePorts = formData.autoDerivePorts !== false;
                         let performance: interfaces.data.IRemoteIngressPerformanceConfig | undefined;
+                        let egress: interfaces.data.IRemoteIngressEgressPolicyConfig;
                         try {
                           performance = this.collectPerformanceOverride(formData);
+                          egress = this.collectEgressPolicy(formData);
                         } catch (err: unknown) {
                           const { DeesToast } = await import('@design.estate/dees-catalog');
                           DeesToast.show({ message: (err as Error).message, type: 'error', duration: 4000 });
@@ -317,7 +323,7 @@ export class OpsViewRemoteIngress extends DeesElement {
                           : undefined;
                         await appstate.remoteIngressStatePart.dispatchAction(
                           appstate.createRemoteIngressAction,
-                          { name, listenPorts, autoDerivePorts, performance, tags },
+                          { name, listenPorts, autoDerivePorts, performance, egress, tags },
                         );
                         await modalArg.destroy();
                       },
@@ -375,6 +381,9 @@ export class OpsViewRemoteIngress extends DeesElement {
                       <dees-input-text .key=${'listenPorts'} .label=${'Manual Ports'} .description=${'Comma-separated port numbers'} .value=${(edge.listenPorts || []).join(', ')}></dees-input-text>
                       <dees-input-checkbox .key=${'autoDerivePorts'} .label=${'Auto-derive ports from routes'} .value=${edge.autoDerivePorts !== false}></dees-input-checkbox>
                       <dees-input-text .key=${'maxStreamsPerEdge'} .label=${'Max Connections'} .description=${'Optional maximum concurrent client connections for this edge. Leave empty to use the hub default.'} .value=${edge.performance?.maxStreamsPerEdge?.toString() || ''}></dees-input-text>
+                      <dees-input-checkbox .key=${'egressEnabled'} .label=${'Allow outbound SMTP egress'} .value=${edge.egress?.enabled === true}></dees-input-checkbox>
+                      <dees-input-text .key=${'egressAllowedHostPatterns'} .label=${'SMTP Egress Host Patterns'} .description=${'Optional comma-separated MX host patterns. Leave empty to allow public MX hosts on port 25.'} .value=${(edge.egress?.allowedHostPatterns || []).join(', ')}></dees-input-text>
+                      <dees-input-text .key=${'egressMaxConcurrentStreams'} .label=${'SMTP Egress Max Streams'} .description=${'Optional concurrent outbound SMTP stream cap for this edge.'} .value=${edge.egress?.maxConcurrentStreams?.toString() || ''}></dees-input-text>
                       <dees-input-text .key=${'tags'} .label=${'Tags'} .description=${'Comma-separated'} .value=${(edge.tags || []).join(', ')}></dees-input-text>
                     </dees-form>
                   `,
@@ -397,8 +406,10 @@ export class OpsViewRemoteIngress extends DeesElement {
                           : [];
                         const autoDerivePorts = formData.autoDerivePorts !== false;
                         let performance: interfaces.data.IRemoteIngressPerformanceConfig | undefined;
+                        let egress: interfaces.data.IRemoteIngressEgressPolicyConfig;
                         try {
                           performance = this.collectPerformanceOverride(formData, edge.performance);
+                          egress = this.collectEgressPolicy(formData, edge.egress);
                         } catch (err: unknown) {
                           const { DeesToast } = await import('@design.estate/dees-catalog');
                           DeesToast.show({ message: (err as Error).message, type: 'error', duration: 4000 });
@@ -415,6 +426,7 @@ export class OpsViewRemoteIngress extends DeesElement {
                             listenPorts,
                             autoDerivePorts,
                             performance,
+                            egress,
                             tags,
                           },
                         );
@@ -534,6 +546,16 @@ export class OpsViewRemoteIngress extends DeesElement {
     `;
   }
 
+  private getEgressHtml(edge: interfaces.data.IRemoteIngress): TemplateResult | string {
+    if (!edge.egress?.enabled) return '-';
+    return html`
+      <div class="metricStack">
+        <strong>SMTP</strong>
+        <span class="metricMuted">port ${(edge.egress.allowedPorts || [25]).join(', ')}</span>
+      </div>
+    `;
+  }
+
   private getTransportHtml(edgeId: string): TemplateResult | string {
     const status = this.getEdgeStatus(edgeId);
     if (!status?.connected) return '-';
@@ -618,6 +640,38 @@ export class OpsViewRemoteIngress extends DeesElement {
     return base ? {} : undefined;
   }
 
+  private collectEgressPolicy(
+    formData: Record<string, any>,
+    base?: interfaces.data.IRemoteIngressEgressPolicyConfig,
+  ): interfaces.data.IRemoteIngressEgressPolicyConfig {
+    const enabled = formData.egressEnabled !== false && Boolean(formData.egressEnabled);
+    if (!enabled) {
+      return { enabled: false };
+    }
+    const next: interfaces.data.IRemoteIngressEgressPolicyConfig = {
+      ...(base || {}),
+      enabled: true,
+      allowedPorts: [25],
+    };
+    const hostPatternsText = `${formData.egressAllowedHostPatterns || ''}`.trim();
+    if (hostPatternsText) {
+      next.allowedHostPatterns = hostPatternsText.split(',').map((pattern) => pattern.trim()).filter(Boolean);
+    } else {
+      delete next.allowedHostPatterns;
+    }
+    const maxStreamsText = `${formData.egressMaxConcurrentStreams || ''}`.trim();
+    if (maxStreamsText) {
+      const maxConcurrentStreams = Number.parseInt(maxStreamsText, 10);
+      if (!Number.isInteger(maxConcurrentStreams) || maxConcurrentStreams < 1) {
+        throw new Error('SMTP Egress Max Streams must be a positive integer');
+      }
+      next.maxConcurrentStreams = maxConcurrentStreams;
+    } else {
+      delete next.maxConcurrentStreams;
+    }
+    return next;
+  }
+
   private async showHubSettingsDialog(): Promise<void> {
     const { DeesModal, DeesToast } = await import('@design.estate/dees-catalog');
     const hubSettings = this.riState.hubSettings;