🐾 feat(settings): register kairos-mail source bucket for ingest

Kairos is about to start announcing rendered mail documents to
POST /library/api/ingest/ with source="kairos-mail". Without a registry
entry, unknown sources fall back to the daedalus bucket and every worker
fetch fails — this adds the KAIROS_S3_* env vars (pattern-copy of the
spelunker block) and the SOURCE_S3_BUCKETS["kairos-mail"] entry, plumbed
through .env.example and the worker service in docker-compose.

Settings-only; no code changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -91,6 +91,19 @@ SPELUNKER_S3_REGION_NAME=us-east-1
 SPELUNKER_S3_USE_SSL=True
 SPELUNKER_S3_VERIFY=True
 
+# --- Kairos S3 (cross-bucket reads for ingest, source="kairos-mail") ---
+# Consumed by: worker only
+# Kairos renders synced mail to text documents in its own bucket and posts
+# ingest requests with source="kairos-mail". These creds should be scoped
+# read-only to the Kairos bucket in your secret manager.
+KAIROS_S3_ENDPOINT_URL=https://nyx.helu.ca:8555
+KAIROS_S3_ACCESS_KEY_ID=
+KAIROS_S3_SECRET_ACCESS_KEY=
+KAIROS_S3_BUCKET_NAME=kairos
+KAIROS_S3_REGION_NAME=us-east-1
+KAIROS_S3_USE_SSL=True
+KAIROS_S3_VERIFY=True
+
 # --- Celery / RabbitMQ (Oberon) ---------------------------------------------
 # Consumed by: app (producer), worker (consumer). NOT mcp.
 # Remember to percent-encode any password characters that have meaning in a

docker-compose.yaml

@@ -346,6 +346,13 @@ services:
       - SPELUNKER_S3_REGION_NAME=${SPELUNKER_S3_REGION_NAME}
       - SPELUNKER_S3_USE_SSL=${SPELUNKER_S3_USE_SSL}
       - SPELUNKER_S3_VERIFY=${SPELUNKER_S3_VERIFY}
+      - KAIROS_S3_ENDPOINT_URL=${KAIROS_S3_ENDPOINT_URL}
+      - KAIROS_S3_ACCESS_KEY_ID=${KAIROS_S3_ACCESS_KEY_ID}
+      - KAIROS_S3_SECRET_ACCESS_KEY=${KAIROS_S3_SECRET_ACCESS_KEY}
+      - KAIROS_S3_BUCKET_NAME=${KAIROS_S3_BUCKET_NAME}
+      - KAIROS_S3_REGION_NAME=${KAIROS_S3_REGION_NAME}
+      - KAIROS_S3_USE_SSL=${KAIROS_S3_USE_SSL}
+      - KAIROS_S3_VERIFY=${KAIROS_S3_VERIFY}
       # Celery / RabbitMQ
       - CELERY_BROKER_URL=${CELERY_BROKER_URL}
       - CELERY_RESULT_BACKEND=${CELERY_RESULT_BACKEND}

mnemosyne/mnemosyne/settings.py

@@ -268,6 +268,15 @@ SPELUNKER_S3_REGION_NAME = env("SPELUNKER_S3_REGION_NAME", default="us-east-1")
 SPELUNKER_S3_USE_SSL = env.bool("SPELUNKER_S3_USE_SSL", default=False)
 SPELUNKER_S3_VERIFY = env.bool("SPELUNKER_S3_VERIFY", default=True)
 
+# Kairos renders synced mail to text documents in its own bucket.
+KAIROS_S3_ENDPOINT_URL = env("KAIROS_S3_ENDPOINT_URL", default="")
+KAIROS_S3_ACCESS_KEY_ID = env("KAIROS_S3_ACCESS_KEY_ID", default="")
+KAIROS_S3_SECRET_ACCESS_KEY = env("KAIROS_S3_SECRET_ACCESS_KEY", default="")
+KAIROS_S3_BUCKET_NAME = env("KAIROS_S3_BUCKET_NAME", default="kairos")
+KAIROS_S3_REGION_NAME = env("KAIROS_S3_REGION_NAME", default="us-east-1")
+KAIROS_S3_USE_SSL = env.bool("KAIROS_S3_USE_SSL", default=False)
+KAIROS_S3_VERIFY = env.bool("KAIROS_S3_VERIFY", default=True)
+
 # Registry keyed by the ingest `source` field. Unknown/blank sources fall
 # back to "daedalus" for backwards compatibility.
 SOURCE_S3_BUCKETS = {
@@ -289,6 +298,15 @@ SOURCE_S3_BUCKETS = {
         "use_ssl": SPELUNKER_S3_USE_SSL,
         "verify": SPELUNKER_S3_VERIFY,
     },
+    "kairos-mail": {
+        "endpoint_url": KAIROS_S3_ENDPOINT_URL,
+        "access_key_id": KAIROS_S3_ACCESS_KEY_ID,
+        "secret_access_key": KAIROS_S3_SECRET_ACCESS_KEY,
+        "bucket_name": KAIROS_S3_BUCKET_NAME,
+        "region_name": KAIROS_S3_REGION_NAME,
+        "use_ssl": KAIROS_S3_USE_SSL,
+        "verify": KAIROS_S3_VERIFY,
+    },
 }
 
 # --- Celery / RabbitMQ ---