Mail configuration as desired state, with a credential-free drift gate
Put mail configuration under version control, and have something tell me when the live system no longer matches what is committed.
It spans two systems with no shared API: the Fastmail account, and mail DNS
across 31 Cloudflare zones. The split that makes it work is desired state
against observed state. config/ and dns/ are hand-edited and reviewed as
diffs. snapshots/ is raw captures, append-only, so the history is real rather
than reconstructed. make diff compares them and exits 1 when they disagree.
The load-bearing detail is that make diff needs no credentials. It reads only
files already in the repo, which means it can run in CI as a drift gate without
handing a token to a build runner. Capture needs secrets; comparison does not.
Writing back to Fastmail is a separate explicit command, kept out of anything
that runs unattended.
Known issues are tracked with an ID and a status each, which suggests the diff has already found real drift.