From a3188264b0a34b0df722b62f026b7e2a1b88dfbb Mon Sep 17 00:00:00 2001 From: Frank Schwenk Date: Sat, 1 Aug 2026 10:51:55 +0200 Subject: [PATCH] fix: load SMTP via secret files on submissions:465 Env-based notifier creds were unreliable; use secrets/smtp_*.txt, RFC5322 sender, and implicit TLS to 0012.de Plesk. Co-authored-by: Cursor --- .env.example | 21 +++++++++++---------- README.md | 25 ++++++++++++++++++------- compose.yml | 4 +--- config/configuration.yml | 12 ++++++++---- 4 files changed, 38 insertions(+), 24 deletions(-) diff --git a/.env.example b/.env.example index 641d3ea..78df798 100644 --- a/.env.example +++ b/.env.example @@ -1,15 +1,16 @@ # Copy to .env on the deploy host. Never commit .env. -# SMTP values: same as ~/git/froxxxy/0012/server.env (Plesk mail) TZ=Europe/Berlin -# --- Authelia crypto (generate on deploy; see README) --- -# Prefer secret files under ./secrets/ (recommended). If you use env instead: -# AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET= -# AUTHELIA_SESSION_SECRET= -# AUTHELIA_STORAGE_ENCRYPTION_KEY= +# Optional: Authelia log level (info|debug|trace) +# AUTHELIA_LOG_LEVEL=info -# --- SMTP (0012.de Plesk) --- -AUTHELIA_NOTIFIER_SMTP_USERNAME=admin@0012.de -AUTHELIA_NOTIFIER_SMTP_PASSWORD= -AUTHELIA_NOTIFIER_SMTP_SENDER=Authelia +# --- SMTP credentials (0012.de Plesk) --- +# Authelia reads these from secret files (not from env): +# secrets/smtp_username.txt e.g. auth@0012.de +# secrets/smtp_password.txt +# secrets/smtp_sender.txt e.g. Authelia +# Create them on the server (see README). Keep this .env for your own notes if useful: +SMTP_USER=auth@0012.de +SMTP_PASSWORD= +SMTP_SENDER=Authelia diff --git a/README.md b/README.md index 671e3c1..8e4866d 100644 --- a/README.md +++ b/README.md @@ -40,8 +40,8 @@ Zusätzlich in diesem Repo unter `config/configuration.yml` → `access_control. | `compose.yml` | Authelia, Redis, whoami-Smoke | | `config/configuration.yml` | Authelia-Config (kein Secret-Inhalt) | | `config/users_database.yml.example` | User-Template | -| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt` (nur auf dem Server) | -| `.env` | SMTP + TZ (nur auf dem Server) | +| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt`, `smtp_username.txt`, `smtp_password.txt`, `smtp_sender.txt` (nur auf dem Server) | +| `.env` | `TZ` (+ optional Log-Level); SMTP-Passwort gehört in `secrets/smtp_*.txt` | ## Deploy (boka) @@ -65,6 +65,18 @@ docker run --rm -u 8000:8000 -v "$(pwd)/secrets:/secrets" authelia/authelia:4.39 session_secret.txt storage_encryption_key.txt jwt_secret.txt' ``` +SMTP (0012.de) — Dateien unter `secrets/` (UID 8000): + +```bash +# as root / via docker if secrets/ is 0700 for uid 8000 +printf '%s\n' 'auth@0012.de' > secrets/smtp_username.txt +printf '%s\n' 'YOUR_SMTP_PASSWORD' > secrets/smtp_password.txt +printf '%s\n' 'Authelia ' > secrets/smtp_sender.txt +chown 8000:8000 secrets/smtp_*.txt && chmod 600 secrets/smtp_*.txt +``` + +Notifier: `submissions://ha01s019.org-dns.com:465` (implizites TLS). Sender-Format muss RFC5322 sein: `Name ` — kein unquoted `foo.bar.baz <…>`. + ### User-DB ```bash @@ -84,11 +96,10 @@ docker compose logs -f authelia ## SMTP (0012.de) -Notifier nutzt Plesk-SMTP wie in `0012` Todo 11 / `server.env`: - -- Host `ha01s019.org-dns.com`, Port `587` (STARTTLS / `submission://`) -- Login `admin@0012.de`, From z.B. `Authelia ` -- Passwort nur in `.env` als `AUTHELIA_NOTIFIER_SMTP_PASSWORD` +- Host `ha01s019.org-dns.com`, Port **465** (`submissions://`), Auth z.B. `auth@0012.de` +- Credentials nur in `secrets/smtp_*.txt` (siehe oben) +- Startup-Check sendet **keine** Mail — nur Verbindungs-Check +- Test von boka: Python/`swaks` an `cuidas@gmail.com`; Authelia-Logs bei Erfolg: Trace `Timing Attack Delay successful: true` nach „Sending an email…“ ## TOTP-Enrollment diff --git a/compose.yml b/compose.yml index f795230..d5a3e3d 100644 --- a/compose.yml +++ b/compose.yml @@ -14,9 +14,7 @@ services: environment: TZ: ${TZ:-Europe/Berlin} X_AUTHELIA_CONFIG_FILTERS: template - AUTHELIA_NOTIFIER_SMTP_USERNAME: ${AUTHELIA_NOTIFIER_SMTP_USERNAME} - AUTHELIA_NOTIFIER_SMTP_PASSWORD: ${AUTHELIA_NOTIFIER_SMTP_PASSWORD} - AUTHELIA_NOTIFIER_SMTP_SENDER: ${AUTHELIA_NOTIFIER_SMTP_SENDER} + AUTHELIA_LOG_LEVEL: ${AUTHELIA_LOG_LEVEL:-info} labels: - traefik.enable=true - traefik.docker.network=traefik diff --git a/config/configuration.yml b/config/configuration.yml index bf3f490..3679685 100644 --- a/config/configuration.yml +++ b/config/configuration.yml @@ -1,6 +1,6 @@ --- # Authelia configuration — secrets via template files under /secrets/ -# SMTP username/password/sender come from environment (see compose.yml / .env) +# SMTP username/password/sender: files in /secrets/smtp_*.txt (see README) server: address: 'tcp://:9091' @@ -73,10 +73,14 @@ storage: notifier: disable_startup_check: false smtp: - address: 'submission://ha01s019.org-dns.com:587' - timeout: '10s' + address: 'submissions://ha01s019.org-dns.com:465' + timeout: '15s' + username: {{ secret "/secrets/smtp_username.txt" | mindent 0 "|" | msquote }} + password: {{ secret "/secrets/smtp_password.txt" | mindent 0 "|" | msquote }} + sender: {{ secret "/secrets/smtp_sender.txt" | mindent 0 "|" | msquote }} + identifier: 'auth.schwenk.online' subject: '[Authelia] {title}' startup_check_address: 'cuidas@gmail.com' disable_require_tls: false disable_starttls: false - # username, password, sender: AUTHELIA_NOTIFIER_SMTP_* from environment + disable_html_emails: false