Document Listmonk newsletter integration

README.md

@@ -52,9 +52,20 @@ The Inference Cooperative runs a self-hosted stack on [Cloudron](https://cloudro
 | **Gitea** | Git hosting (code + docs) | git.inference.coop |
 | **Loomio** | Member governance | forum.inference.coop |
 | **Open Collective** | Membership billing + fiscal sponsorship | opencollective.com/inference-cooperative |
+| **Listmonk** | Member newsletter (list auto-synced from membership) | newsletter.inference.coop |
 
 The cooperative's software is open source and lives in the [`code`](https://git.inference.coop/code) organization on our Gitea instance.
 
+### Newsletter
+
+Member newsletters are sent via **Listmonk** (self-hosted, at `newsletter.inference.coop`).
+
+- **Single source of truth:** the portal database. Listmonk is *not* managed by hand.
+- **Auto-sync:** the portal subscribes a member to the "Members" list on provisioning, and unsubscribes them on deactivation (both in the webhook path and the nightly sweep). It's best-effort — a newsletter outage can't break onboarding.
+- **Opt-in model:** single opt-in. Members consent by joining, so they're auto-confirmed rather than double-opted-in (no second confirmation email at signup).
+- **Sender:** `info@inference.coop` via Cloudron's mail addon, inheriting the domain's SPF/DKIM/DMARC alignment.
+- **Machine credential:** the portal authenticates to listmonk using a dedicated API user (`portal-sync`) with a token stored in the portal's Cloudron env vars (`LISTMONK_API_TOKEN`), not a password. Human admins log into listmonk via Cloudron SSO; password login is disabled.
+
 ### Models
 
 The gateway currently exposes three models (all served through Tinfoil's TEE-protected enclaves):