froxxxy/authschwenkonline
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: load SMTP via secret files on submissions:465

Browse Source 
Env-based notifier creds were unreliable; use secrets/smtp_*.txt, RFC5322 sender, and implicit TLS to 0012.de Plesk.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Frank Schwenk
2026-08-01 10:51:55 +02:00
parent 93c78f503e
commit a3188264b0
4 changed files with 38 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+11 -10
View File
@@ -1,15 +1,16 @@
# Copy to .env on the deploy host. Never commit .env.
# SMTP values: same as ~/git/froxxxy/0012/server.env (Plesk mail)
TZ=Europe/Berlin
# --- Authelia crypto (generate on deploy; see README) ---
# Prefer secret files under ./secrets/ (recommended). If you use env instead:
# AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=
# AUTHELIA_SESSION_SECRET=
# AUTHELIA_STORAGE_ENCRYPTION_KEY=
# Optional: Authelia log level (info|debug|trace)
# AUTHELIA_LOG_LEVEL=info
# --- SMTP (0012.de Plesk) ---
AUTHELIA_NOTIFIER_SMTP_USERNAME=admin@0012.de
AUTHELIA_NOTIFIER_SMTP_PASSWORD=
AUTHELIA_NOTIFIER_SMTP_SENDER=Authelia <monitor@0012.de>
# --- SMTP credentials (0012.de Plesk) ---
# Authelia reads these from secret files (not from env):
# secrets/smtp_username.txt e.g. auth@0012.de
# secrets/smtp_password.txt
# secrets/smtp_sender.txt e.g. Authelia <auth@0012.de>
# Create them on the server (see README). Keep this .env for your own notes if useful:
SMTP_USER=auth@0012.de
SMTP_PASSWORD=
SMTP_SENDER=Authelia <auth@0012.de>
README.md
+18 -7
View File
@@ -40,8 +40,8 @@ Zusätzlich in diesem Repo unter `config/configuration.yml` → `access_control.
| `compose.yml` | Authelia, Redis, whoami-Smoke |
| `config/configuration.yml` | Authelia-Config (kein Secret-Inhalt) |
| `config/users_database.yml.example` | User-Template |
| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt` (nur auf dem Server) |
| `.env` | SMTP + TZ (nur auf dem Server) |
| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt`, `smtp_username.txt`, `smtp_password.txt`, `smtp_sender.txt` (nur auf dem Server) |
| `.env` | `TZ` (+ optional Log-Level); SMTP-Passwort gehört in `secrets/smtp_*.txt` |
## Deploy (boka)
@@ -65,6 +65,18 @@ docker run --rm -u 8000:8000 -v "$(pwd)/secrets:/secrets" authelia/authelia:4.39
session_secret.txt storage_encryption_key.txt jwt_secret.txt'
```
SMTP (0012.de) — Dateien unter `secrets/` (UID 8000):
```bash
# as root / via docker if secrets/ is 0700 for uid 8000
printf '%s\n' 'auth@0012.de' > secrets/smtp_username.txt
printf '%s\n' 'YOUR_SMTP_PASSWORD' > secrets/smtp_password.txt
printf '%s\n' 'Authelia <auth@0012.de>' > secrets/smtp_sender.txt
chown 8000:8000 secrets/smtp_*.txt && chmod 600 secrets/smtp_*.txt
```
Notifier: `submissions://ha01s019.org-dns.com:465` (implizites TLS). Sender-Format muss RFC5322 sein: `Name <user@domain>` — kein unquoted `foo.bar.baz <…>`.
### User-DB
```bash
@@ -84,11 +96,10 @@ docker compose logs -f authelia
## SMTP (0012.de)
Notifier nutzt Plesk-SMTP wie in `0012` Todo 11 / `server.env`:
- Host `ha01s019.org-dns.com`, Port `587` (STARTTLS / `submission://`)
- Login `admin@0012.de`, From z.B. `Authelia <monitor@0012.de>`
- Passwort nur in `.env` als `AUTHELIA_NOTIFIER_SMTP_PASSWORD`
- Host `ha01s019.org-dns.com`, Port **465** (`submissions://`), Auth z.B. `auth@0012.de`
- Credentials nur in `secrets/smtp_*.txt` (siehe oben)
- Startup-Check sendet **keine** Mail — nur Verbindungs-Check
- Test von boka: Python/`swaks` an `cuidas@gmail.com`; Authelia-Logs bei Erfolg: Trace `Timing Attack Delay successful: true` nach „Sending an email…“
## TOTP-Enrollment
compose.yml
+1 -3
View File
@@ -14,9 +14,7 @@ services:
environment:
TZ: ${TZ:-Europe/Berlin}
X_AUTHELIA_CONFIG_FILTERS: template
AUTHELIA_NOTIFIER_SMTP_USERNAME: ${AUTHELIA_NOTIFIER_SMTP_USERNAME}
AUTHELIA_NOTIFIER_SMTP_PASSWORD: ${AUTHELIA_NOTIFIER_SMTP_PASSWORD}
AUTHELIA_NOTIFIER_SMTP_SENDER: ${AUTHELIA_NOTIFIER_SMTP_SENDER}
AUTHELIA_LOG_LEVEL: ${AUTHELIA_LOG_LEVEL:-info}
labels:
- traefik.enable=true
- traefik.docker.network=traefik
config/configuration.yml
+8 -4
View File
@@ -1,6 +1,6 @@
---
# Authelia configuration — secrets via template files under /secrets/
# SMTP username/password/sender come from environment (see compose.yml / .env)
# SMTP username/password/sender: files in /secrets/smtp_*.txt (see README)
server:
address: 'tcp://:9091'
@@ -73,10 +73,14 @@ storage:
notifier:
disable_startup_check: false
smtp:
address: 'submission://ha01s019.org-dns.com:587'
timeout: '10s'
address: 'submissions://ha01s019.org-dns.com:465'
timeout: '15s'
username: {{ secret "/secrets/smtp_username.txt" | mindent 0 "|" | msquote }}
password: {{ secret "/secrets/smtp_password.txt" | mindent 0 "|" | msquote }}
sender: {{ secret "/secrets/smtp_sender.txt" | mindent 0 "|" | msquote }}
identifier: 'auth.schwenk.online'
subject: '[Authelia] {title}'
startup_check_address: 'cuidas@gmail.com'
disable_require_tls: false
disable_starttls: false
# username, password, sender: AUTHELIA_NOTIFIER_SMTP_* from environment
disable_html_emails: false