mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-07 19:32:17 +00:00
kevinveenbirkenbachandClaude Opus 5
04a5d0c74d
Friendica 0 and WordPress 0 of run 31543714113 never delivered their startup mail. An onion relay has no TLS certificate, so the resolver forces tls=false - and both port and auth hung off that flag: port collapsed to 25 and auth to off. Port 25 is the inbound MX and offers no SMTP AUTH at all, so the message reached Mailu unauthenticated with a local envelope sender and rspamd rejected it 554 5.7.1. Port and auth now hang off `external` instead: 465 with TLS, 587 without, and auth wherever a relay is external.
Moving the port alone would only relocate the failure. msmtp refuses to pick PLAIN or LOGIN itself on a cleartext link and aborts with EX_UNAVAILABLE, so the mechanism has to be named. The new `auth_mechanism` key resolves to off, on, or plain and sits in RESOLUTION_ORDER right after auth, whose result plus tls it reads.
It is one derived value rather than two template expressions because the two failing jobs run different msmtp instances: WordPress renders sys-svc-mail-msmtp/templates/msmtprc.conf.j2 through WORDPRESS_MSMTP_SRC and mounts it at /etc/msmtprc, while Friendica generates its own from SMTP_AUTH via the image script, whose line 32 writes `auth $smtp_auth` verbatim. Both now read the same key.
Verified against the shipped Mailu 2024.06 front rather than assumed. EHLO on 587 under TLS_FLAVOR=notls answers `250-AUTH PLAIN LOGIN`, so PLAIN is offered on the cleartext link; dovecot renders disable_plaintext_auth=no in that flavor. PORT_587 is set because socrate lists 587 outside PORTS_REQUIRING_TLS, unlike 465, which notls skips - so 587 is the only submission port available there. smtp and submission bind identically to MAILU_IP4_PUBLIC, so the path to 587 is the one that already reached 25.
This supersedes the premise of 563da9e5b, which disabled AUTH because the resolver had. That commit quoted a different msmtp error - "the server does not support authentication" - which was port 25 having none, not the relay refusing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
33 lines
1.2 KiB
Django/Jinja
33 lines
1.2 KiB
Django/Jinja
{% include 'roles/sys-svc-container/templates/env.j2' %}
|
|
|
|
FRIENDICA_URL={{ FRIENDICA_BASE_URL }}
|
|
HOSTNAME={{ lookup('domain',application_id) }}
|
|
FRIENDICA_NO_VALIDATION={{ FRIENDICA_OIDC_ENABLED | bool | string | lower }}
|
|
|
|
FRIENDICA_DEBUGGING={{ (MODE_DEBUG | bool) | lower }}{{"\n"}}
|
|
FRIENDICA_LOGLEVEL={% if MODE_DEBUG | bool %}9{% else %}5{% endif %}{{"\n"}}
|
|
FRIENDICA_LOGGER=syslog
|
|
|
|
MYSQL_HOST={{ lookup('database', application_id, 'host') }}:{{ lookup('database', application_id, 'port') }}
|
|
MYSQL_DATABASE={{ lookup('database', application_id, 'name') }}
|
|
MYSQL_USER={{ lookup('database', application_id, 'username') }}
|
|
MYSQL_PASSWORD={{ lookup('database', application_id, 'password') | dotenv_quote }}
|
|
|
|
{% set email = lookup('email', application_id) %}
|
|
{% if email.enabled | bool %}
|
|
SMTP={{ email.host }}
|
|
SMTP_DOMAIN={{ email.domain }}
|
|
SMTP_PORT={{ email.port }}
|
|
SMTP_AUTH={{ email.auth_mechanism }}
|
|
{% if email.auth | bool %}
|
|
SMTP_AUTH_USER={{ email.username }}
|
|
SMTP_AUTH_PASS={{ email.password }}
|
|
{% endif %}
|
|
SMTP_TLS={{ 'on' if email.tls else 'off' }}
|
|
SMTP_STARTTLS={{ 'on' if email.start_tls else 'off' }}
|
|
SMTP_FROM=no-reply
|
|
{% endif %}
|
|
|
|
FRIENDICA_ADMIN_MAIL={{ lookup('users', 'administrator').email }}
|
|
MAILNAME={{ lookup('users', 'administrator').email }}
|