app-email: calcom+nextcloud wired & send-tested; calcom healthcheck GET fix + docs
calcom + nextcloud both send live via the :2526 plaintext listener (calcom signup = Nodemailer; nextcloud password-reset = Symfony Mailer), both From <app>@felhom.eu. calcom healthcheck: wget GET not --spider (HEAD 405s). CHANGELOG + REPORT. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -1,5 +1,19 @@
|
||||
# Changelog
|
||||
|
||||
## 2026-06-29 — App-email: calcom + nextcloud (tls_mode=plaintext :2526 + nextcloud split-From)
|
||||
- **nextcloud** — `smtp_mapping` with `tls_mode: plaintext` (controller injects port 2526, the plaintext-only
|
||||
listener) + **split From** (`from_var=MAIL_FROM_ADDRESS` + `from_domain_var=MAIL_DOMAIN` → nextcloud@felhom.eu).
|
||||
Compose references the injected `${SMTP_*}`/`${MAIL_*}`. Live-confirmed: real password-reset delivered via
|
||||
plaintext :2526 (Symfony Mailer never attempted STARTTLS).
|
||||
- **calcom** — `smtp_mapping` with `tls_mode: plaintext` (EMAIL_SERVER_HOST/PORT, EMAIL_FROM=calcom@felhom.eu).
|
||||
**Plus three pre-existing template fixes** (calcom never deployed before — the image pin was invalid):
|
||||
(1) image `v4.8.7`→`v4.6.9` (the pinned tag has no published image); (2) added required `DATABASE_DIRECT_URL`
|
||||
(Prisma `migrate deploy` fails without it → incomplete schema → 500s); (3) healthcheck `/api/health`→
|
||||
`/api/auth/providers` (the old path 404s in v4.x → container stayed unhealthy → Traefik wouldn't route).
|
||||
- Both apps point at the controller's `:2526` plaintext-only listener because their SMTP clients
|
||||
opportunistically STARTTLS-upgrade and can't skip the self-signed cert — the listener simply doesn't offer
|
||||
STARTTLS, so they stay plaintext (accepted on the single-tenant app bridge).
|
||||
|
||||
## 2026-06-29 — App-email rollout: gitea + rallly (calcom/nextcloud/immich = findings)
|
||||
- **gitea 1.23.4** — added `smtp_mapping` (STARTTLS via `GITEA__mailer__PROTOCOL=smtp+starttls` +
|
||||
`FORCE_TRUST_SERVER_CERT=true` to trust the shim's self-signed cert; single `GITEA__mailer__FROM`). Compose
|
||||
|
||||
@@ -1,71 +1,39 @@
|
||||
# REPORT — App-email rollout: gitea + rallly wired (calcom/nextcloud/immich = findings)
|
||||
# REPORT — App-email gap closure: calcom + nextcloud wired (plaintext :2526 + split-From)
|
||||
|
||||
**Date:** 2026-06-29
|
||||
**Task:** Roll out the shipped app-email relay (controller v0.88.0 shim + `smtp_mapping`; hub v0.18.0 passthrough)
|
||||
to calcom, rallly, gitea, nextcloud (+ investigate immich). Catalog-only; no controller/hub code change.
|
||||
**Task:** Wire cal.com + nextcloud now that the controller (v0.89.0) has the `:2526` plaintext-only listener
|
||||
(Gap 1) and `tls_mode`/`from_domain_var` mapping fields (Gap 2). Catalog-only; live send-tests.
|
||||
|
||||
## Baselines (verified live)
|
||||
- felhom-controller **v0.88.0** + hub **v0.18.0** live (relay mechanism shipped). Global app-email toggle ON on
|
||||
guest 9201. Guest RAM **12 GB** (raised from 2 GB) — confirmed before deploying heavier apps.
|
||||
## Mappings added
|
||||
- **nextcloud** (`tls_mode: plaintext`, split From): `host_var=SMTP_HOST`, `port_var=SMTP_PORT`,
|
||||
`from_var=MAIL_FROM_ADDRESS`, `from_domain_var=MAIL_DOMAIN`, `from_local=nextcloud`; no `security_var`
|
||||
(`SMTP_SECURE` stays empty = no TLS). Compose references the injected `${SMTP_*}` + `${MAIL_*}`.
|
||||
**Live send confirmed:** real password-reset → Symfony Mailer **plaintext to :2526** (no STARTTLS) → hub →
|
||||
Resend, From `nextcloud@felhom.eu` (split From), shim `hub=200`. nextcloud applied the env on redeploy
|
||||
(`occ` shows `mail_smtpport=2526`, `mail_from_address=nextcloud`, `mail_domain=felhom.eu`) — every-boot
|
||||
`getenv`, **no occ step needed (§8)**.
|
||||
- **cal.com** (`tls_mode: plaintext`): `host_var=EMAIL_SERVER_HOST`, `port_var=EMAIL_SERVER_PORT`,
|
||||
`from_var=EMAIL_FROM`, `from_name_var=EMAIL_FROM_NAME`, `from_local=calcom`; secure inferred from the port
|
||||
(2526 → plaintext). Compose references the injected `${EMAIL_*}`. Injected env verified in-container
|
||||
(`EMAIL_SERVER_PORT=2526`, `EMAIL_FROM=calcom@felhom.eu`). **Live send confirmed:** a real signup (201
|
||||
"Created user") → Nodemailer **plaintext to :2526** (no STARTTLS) → hub → Resend, From `calcom@felhom.eu`,
|
||||
shim `hub=200`.
|
||||
|
||||
## Per-app outcome
|
||||
## Pre-existing cal.com template bugs fixed (never caught — bad pin meant calcom never deployed)
|
||||
1. **Image pin `calcom/cal.com:v4.8.7` doesn't exist** as a published image (manifest unknown) → `v4.6.9`
|
||||
(nearest valid 4.x; same `EMAIL_SERVER_*` behaviour).
|
||||
2. **Missing `DATABASE_DIRECT_URL`** — cal.com's Prisma schema declares `directUrl=env(DATABASE_DIRECT_URL)`;
|
||||
without it `prisma migrate deploy` fails (P1012) on startup → incomplete schema → `/api/health` 500s. Added
|
||||
(same direct Postgres URL).
|
||||
3. **Healthcheck path `/api/health` is 404 in v4.x** → container stayed unhealthy → Traefik wouldn't route it.
|
||||
Changed to `/api/auth/providers` (stable 200) in both the docker healthcheck and the `.felhom.yml` probe.
|
||||
|
||||
| App | Wired? | Shape | Self-signed handling | From | Env consumed on redeploy | Live send-test |
|
||||
|-----|--------|-------|----------------------|------|--------------------------|----------------|
|
||||
| **gitea 1.23.4** | ✅ | STARTTLS (`smtp+starttls`) | `FORCE_TRUST_SERVER_CERT=true` | single `GITEA__mailer__FROM` | **Yes** (env→app.ini every boot) | ✅ **arrived** — password-reset email, From `gitea@felhom.eu` |
|
||||
| **rallly 3.11.2** | ✅ | STARTTLS (`SMTP_SECURE=false`) | `SMTP_REJECT_UNAUTHORIZED=false` | single `NOREPLY_EMAIL` | **Yes** (read at send time) | ✅ **arrived** — registration code, From `rallly@felhom.eu` |
|
||||
| **cal.com v4.8.7** | ❌ finding | — | **none** (hard-coded `rejectUnauthorized:true`) | single `EMAIL_FROM` | n/a | not wired |
|
||||
| **nextcloud 31.0.14** | ❌ finding | — | **none** + **split From** | `MAIL_FROM_ADDRESS`+`MAIL_DOMAIN` | n/a | not wired |
|
||||
| **immich v2.5.5** | ❌ finding | — | `ignoreCert` (config-file/UI only) | single (config field) | n/a | not wired |
|
||||
## Validation
|
||||
- All four edited files YAML-validated; field names match the controller's `stacks.SMTPMapping` tags.
|
||||
- The `:2526` plaintext-no-STARTTLS mechanism is proven end-to-end by the nextcloud real send; cal.com uses the
|
||||
identical mechanism (Nodemailer) with its env verified.
|
||||
|
||||
Findings detail: `felhom.eu/documentation/audits/FINDING-app-email-rollout-2026-06-29.md`.
|
||||
|
||||
### gitea 1.23.4 — WIRED, send confirmed
|
||||
- **Mapping** (`smtp_mapping`): `host_var=GITEA__mailer__SMTP_ADDR`, `port_var=GITEA__mailer__SMTP_PORT`,
|
||||
`security_var=GITEA__mailer__PROTOCOL` (`smtp+starttls`), `from_var=GITEA__mailer__FROM`, `from_local=gitea`,
|
||||
`extra={GITEA__mailer__ENABLED:true, GITEA__mailer__FORCE_TRUST_SERVER_CERT:true}`.
|
||||
- **Verified live:** toggle ON → controller injected all six `GITEA__mailer__*` env vars (confirmed in the
|
||||
running container) → gitea wrote the correct `[mailer]` section in app.ini (env→ini every boot). Completed
|
||||
the install (admin = the test inbox) and triggered a **password-reset** (forgot-password): the shim logged
|
||||
`relayed (from="gitea@felhom.eu" rcpts=1 bytes=2195 hub=200)`, the hub logged `/api/v1/mail: relayed`. Go
|
||||
`net/smtp` STARTTLS to the self-signed shim, trusting it via FORCE_TRUST_SERVER_CERT — works.
|
||||
|
||||
### rallly 3.11.2 — WIRED, send confirmed (+ 2 pre-existing template bugs fixed)
|
||||
- **Mapping:** `host_var=SMTP_HOST`, `port_var=SMTP_PORT`, `security_var=SMTP_SECURE` (`false`),
|
||||
`from_var=NOREPLY_EMAIL`, `from_name_var=NOREPLY_EMAIL_NAME`, `from_local=rallly`,
|
||||
`extra={SMTP_REJECT_UNAUTHORIZED:false}`.
|
||||
- **Verified live:** toggle ON → injected env confirmed (`SMTP_HOST=felhom-controller`,
|
||||
`NOREPLY_EMAIL=rallly@felhom.eu`, `SMTP_SECURE=false`, `SMTP_REJECT_UNAUTHORIZED=false`). Drove the **real
|
||||
registration** flow in the browser → rallly's Nodemailer sent the verification code: shim logged
|
||||
`relayed (from="rallly@felhom.eu" rcpts=1 bytes=12755 hub=200)`, hub logged `/api/v1/mail: relayed`.
|
||||
Nodemailer opportunistic STARTTLS to the self-signed shim, accepted via reject-unauthorized=false — works.
|
||||
- **Side-fixes (pre-existing, undeployable template):**
|
||||
1. Image pin `lukevella/rallly:3.12.1` **does not exist** (3.x stops at 3.11.x) → corrected to **3.11.2**.
|
||||
2. Healthcheck used `wget`, which the rallly image **does not ship** (exit 127) → container marked unhealthy
|
||||
→ **Traefik refused to publish a route** (the "URL nem elérhető" warning). Replaced with a Node http
|
||||
check. After the fix rallly is healthy and Traefik routes it. (Diagnosis credit: the operator spotted the
|
||||
unhealthy↔no-route correlation.)
|
||||
3. rallly **requires** `SUPPORT_EMAIL` + a valid `NOREPLY_EMAIL` at boot (refuses to start otherwise) — added
|
||||
valid defaults so it boots with app-email off; the relay overrides `NOREPLY_EMAIL` when on.
|
||||
|
||||
### immich investigation (Task §6)
|
||||
immich v2.5.5 has **no SMTP environment variables**. Email is system config (admin UI → DB) or a JSON file via
|
||||
`IMMICH_CONFIG_FILE` (which supports `ignoreCert:true` for the self-signed shim). It does **not** fit the
|
||||
env-injection `smtp_mapping` model. **Left unwired** — needs a future config-file-injection mechanism or manual
|
||||
admin-UI setup. See the finding doc.
|
||||
|
||||
## Observations / mechanism gaps (for follow-on)
|
||||
- **Gap 1 — self-signed STARTTLS vs opportunistic-upgrade clients with no skip-verify** (cal.com; nextcloud's
|
||||
TLS half). The shim advertises STARTTLS on :2525; Nodemailer/Symfony clients auto-upgrade and validate the
|
||||
cert. Apps without a skip flag fail. **Fix:** a plaintext-only listener that does NOT advertise STARTTLS
|
||||
(controller change) — the highest-coverage unblock.
|
||||
- **Gap 2 — split From** (nextcloud `MAIL_FROM_ADDRESS`+`MAIL_DOMAIN`): the single `from_var` can't express it.
|
||||
**Fix:** add an optional `from_domain_var`.
|
||||
- **Gap 3 — no-SMTP-env apps** (immich): needs config-file injection (a separate, larger capability).
|
||||
- An app that needs SMTP only at first-install was NOT found among these — gitea and nextcloud both re-apply
|
||||
every boot; rallly reads at send time.
|
||||
- **Remaining email-capable apps still unwired** (future passes): ghost, outline, grafana, docmost, bookstack,
|
||||
n8n, paperless-ngx, … — each needs the same per-app determination, and the opportunistic-STARTTLS ones need
|
||||
Gap-1's plaintext listener first.
|
||||
|
||||
No secrets in any committed file; the Resend key stays hub-side (out-of-band).
|
||||
## Notes
|
||||
- **immich still unwired by decision** (Gap 3 — no SMTP env; needs config-file injection).
|
||||
- Other email-capable apps (ghost, outline, grafana, …) now wire as `tls_mode: plaintext` with no per-app TLS
|
||||
determination. No secrets in any committed file.
|
||||
|
||||
@@ -41,7 +41,8 @@ services:
|
||||
limits:
|
||||
memory: 768M
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/api/auth/providers"]
|
||||
# GET (-O /dev/null), not --spider (HEAD): the Next.js API route rejects HEAD, so --spider flaps unhealthy.
|
||||
test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://localhost:3000/api/auth/providers"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
|
||||
Reference in New Issue
Block a user