From d01afd620315710f706868e9a8966c0972d8b1ec Mon Sep 17 00:00:00 2001
From: Robert Helewka <r@helu.ca>
Date: Sun, 12 Jul 2026 07:36:12 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=BE=20feat(settings):=20register=20kai?=
 =?UTF-8?q?ros-mail=20source=20bucket=20for=20ingest?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Kairos is about to start announcing rendered mail documents to
POST /library/api/ingest/ with source="kairos-mail". Without a registry
entry, unknown sources fall back to the daedalus bucket and every worker
fetch fails — this adds the KAIROS_S3_* env vars (pattern-copy of the
spelunker block) and the SOURCE_S3_BUCKETS["kairos-mail"] entry, plumbed
through .env.example and the worker service in docker-compose.

Settings-only; no code changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .env.example                    | 13 +++++++++++++
 docker-compose.yaml             |  7 +++++++
 mnemosyne/mnemosyne/settings.py | 18 ++++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/.env.example b/.env.example
index 07f4e30..1de1b09 100644
--- a/.env.example
+++ b/.env.example
@@ -91,6 +91,19 @@ SPELUNKER_S3_REGION_NAME=us-east-1
 SPELUNKER_S3_USE_SSL=True
 SPELUNKER_S3_VERIFY=True
 
+# --- Kairos S3 (cross-bucket reads for ingest, source="kairos-mail") ---
+# Consumed by: worker only
+# Kairos renders synced mail to text documents in its own bucket and posts
+# ingest requests with source="kairos-mail". These creds should be scoped
+# read-only to the Kairos bucket in your secret manager.
+KAIROS_S3_ENDPOINT_URL=https://nyx.helu.ca:8555
+KAIROS_S3_ACCESS_KEY_ID=
+KAIROS_S3_SECRET_ACCESS_KEY=
+KAIROS_S3_BUCKET_NAME=kairos
+KAIROS_S3_REGION_NAME=us-east-1
+KAIROS_S3_USE_SSL=True
+KAIROS_S3_VERIFY=True
+
 # --- Celery / RabbitMQ (Oberon) ---------------------------------------------
 # Consumed by: app (producer), worker (consumer). NOT mcp.
 # Remember to percent-encode any password characters that have meaning in a
diff --git a/docker-compose.yaml b/docker-compose.yaml
index f3362ae..ef88be8 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -346,6 +346,13 @@ services:
       - SPELUNKER_S3_REGION_NAME=${SPELUNKER_S3_REGION_NAME}
       - SPELUNKER_S3_USE_SSL=${SPELUNKER_S3_USE_SSL}
       - SPELUNKER_S3_VERIFY=${SPELUNKER_S3_VERIFY}
+      - KAIROS_S3_ENDPOINT_URL=${KAIROS_S3_ENDPOINT_URL}
+      - KAIROS_S3_ACCESS_KEY_ID=${KAIROS_S3_ACCESS_KEY_ID}
+      - KAIROS_S3_SECRET_ACCESS_KEY=${KAIROS_S3_SECRET_ACCESS_KEY}
+      - KAIROS_S3_BUCKET_NAME=${KAIROS_S3_BUCKET_NAME}
+      - KAIROS_S3_REGION_NAME=${KAIROS_S3_REGION_NAME}
+      - KAIROS_S3_USE_SSL=${KAIROS_S3_USE_SSL}
+      - KAIROS_S3_VERIFY=${KAIROS_S3_VERIFY}
       # Celery / RabbitMQ
       - CELERY_BROKER_URL=${CELERY_BROKER_URL}
       - CELERY_RESULT_BACKEND=${CELERY_RESULT_BACKEND}
diff --git a/mnemosyne/mnemosyne/settings.py b/mnemosyne/mnemosyne/settings.py
index c71b6d8..4c73f5f 100644
--- a/mnemosyne/mnemosyne/settings.py
+++ b/mnemosyne/mnemosyne/settings.py
@@ -268,6 +268,15 @@ SPELUNKER_S3_REGION_NAME = env("SPELUNKER_S3_REGION_NAME", default="us-east-1")
 SPELUNKER_S3_USE_SSL = env.bool("SPELUNKER_S3_USE_SSL", default=False)
 SPELUNKER_S3_VERIFY = env.bool("SPELUNKER_S3_VERIFY", default=True)
 
+# Kairos renders synced mail to text documents in its own bucket.
+KAIROS_S3_ENDPOINT_URL = env("KAIROS_S3_ENDPOINT_URL", default="")
+KAIROS_S3_ACCESS_KEY_ID = env("KAIROS_S3_ACCESS_KEY_ID", default="")
+KAIROS_S3_SECRET_ACCESS_KEY = env("KAIROS_S3_SECRET_ACCESS_KEY", default="")
+KAIROS_S3_BUCKET_NAME = env("KAIROS_S3_BUCKET_NAME", default="kairos")
+KAIROS_S3_REGION_NAME = env("KAIROS_S3_REGION_NAME", default="us-east-1")
+KAIROS_S3_USE_SSL = env.bool("KAIROS_S3_USE_SSL", default=False)
+KAIROS_S3_VERIFY = env.bool("KAIROS_S3_VERIFY", default=True)
+
 # Registry keyed by the ingest `source` field. Unknown/blank sources fall
 # back to "daedalus" for backwards compatibility.
 SOURCE_S3_BUCKETS = {
@@ -289,6 +298,15 @@ SOURCE_S3_BUCKETS = {
         "use_ssl": SPELUNKER_S3_USE_SSL,
         "verify": SPELUNKER_S3_VERIFY,
     },
+    "kairos-mail": {
+        "endpoint_url": KAIROS_S3_ENDPOINT_URL,
+        "access_key_id": KAIROS_S3_ACCESS_KEY_ID,
+        "secret_access_key": KAIROS_S3_SECRET_ACCESS_KEY,
+        "bucket_name": KAIROS_S3_BUCKET_NAME,
+        "region_name": KAIROS_S3_REGION_NAME,
+        "use_ssl": KAIROS_S3_USE_SSL,
+        "verify": KAIROS_S3_VERIFY,
+    },
 }
 
 # --- Celery / RabbitMQ ---
-- 
2.43.0