From 854c4b300521fad7f8290b8b46750ba5cbf78749 Mon Sep 17 00:00:00 2001
From: Ilia Denisov <evilcart@gmail.com>
Date: Fri, 3 Jul 2026 15:30:39 +0200
Subject: [PATCH] fix(deploy): stage blackbox config + derive bare Grafana SMTP
 from-address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two contour-deploy failures from PR4: (1) the deploy did not stage deploy/blackbox/, so
blackbox_exporter crash-looped on a missing config mount — add blackbox to the ci.yaml cp
and the prod-deploy tar; (2) Grafana rejects the 'Name <addr>' From form the backend go-mail
accepts and validates it even when SMTP is disabled, crash-looping Grafana — the deploy now
splits SMTP_RELAY_SERVICE_FROM into a bare GF_SMTP_FROM_ADDRESS + GRAFANA_SMTP_FROM_NAME
(handles both display and bare forms). Verified the sed split + compose render.
---
 .gitea/workflows/ci.yaml          | 14 +++++++++++++-
 .gitea/workflows/prod-deploy.yaml | 14 +++++++++++++-
 deploy/.env.example               |  2 +-
 deploy/docker-compose.yml         |  4 +++-
 4 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 698f619..5e2091a 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -384,8 +384,20 @@ jobs:
           conf="$HOME/.scrabble-deploy"
           rm -rf "$conf"
           mkdir -p "$conf"
-          cp -r caddy otelcol prometheus tempo grafana "$conf"/
+          cp -r caddy otelcol prometheus tempo grafana blackbox "$conf"/
           export SCRABBLE_CONFIG_DIR="$conf"
+          # Grafana's SMTP from_address must be a BARE address (it rejects the "Name" <addr>
+          # form the backend go-mail accepts) and validates it even when SMTP is disabled — a
+          # bad value crash-loops Grafana. Split the display-format SERVICE From into a bare
+          # address + name for Grafana; the backend keeps the full form.
+          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
+          case "$svc_from" in
+            *"<"*">"*)
+              export GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
+              export GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
+            *)
+              export GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
+          esac
           # Bot-link mTLS material for the test contour: a private CA + gateway/bot
           # leaves (CN=gateway, the service name the bot dials). Prod supplies these
           # from PROD_ secrets instead. Regenerated each deploy; both ends redeploy
diff --git a/.gitea/workflows/prod-deploy.yaml b/.gitea/workflows/prod-deploy.yaml
index 0d76345..9ee55ee 100644
--- a/.gitea/workflows/prod-deploy.yaml
+++ b/.gitea/workflows/prod-deploy.yaml
@@ -140,6 +140,16 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-main
+          # Grafana needs a BARE from-address (it rejects the "Name" <addr> form the backend
+          # accepts, and validates it even when disabled); split the display-format here.
+          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
+          GRAFANA_SMTP_FROM_NAME=''
+          case "$svc_from" in
+            *"<"*">"*)
+              GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
+              GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
+            *) GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
+          esac
           cat > stage/env.sh <<EOF
           export REGISTRY='$REGISTRY'
           export SCRABBLE_CONFIG_DIR='/opt/scrabble'
@@ -167,6 +177,8 @@ jobs:
           export SMTP_RELAY_ADMIN_FROM='$SMTP_RELAY_ADMIN_FROM'
           export ADMIN_EMAIL='$ADMIN_EMAIL'
           export SMTP_RELAY_SERVICE_FROM='$SMTP_RELAY_SERVICE_FROM'
+          export GRAFANA_SMTP_FROM_ADDRESS='$GRAFANA_SMTP_FROM_ADDRESS'
+          export GRAFANA_SMTP_FROM_NAME='$GRAFANA_SMTP_FROM_NAME'
           export SERVICE_EMAIL='$SERVICE_EMAIL'
           export GRAFANA_SMTP_PORT='$GRAFANA_SMTP_PORT'
           export GF_SMTP_ENABLED='$GF_SMTP_ENABLED'
@@ -183,7 +195,7 @@ jobs:
           ssh_main 'mkdir -p /opt/scrabble/compose'
           tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
             | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C deploy -czf - caddy otelcol prometheus tempo grafana \
+          tar -C deploy -czf - caddy otelcol prometheus tempo grafana blackbox \
             | ssh_main 'tar -C /opt/scrabble -xzf -'
           tar -C stage -czf - certs-main \
             | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
diff --git a/deploy/.env.example b/deploy/.env.example
index c646e60..c8b1b13 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -51,7 +51,7 @@ PUBLIC_BASE_URL=                       # required when SMTP_RELAY_HOST is set (e
 # port (it can't do the backend's implicit TLS), GRAFANA_SMTP_PORT. All empty = off.
 SMTP_RELAY_ADMIN_FROM=                 # backend admin-alert From (e.g. alerts@erudit-game.ru)
 ADMIN_EMAIL=                           # backend admin-alert recipient(s), comma-separated
-SMTP_RELAY_SERVICE_FROM=               # Grafana alert From (e.g. grafana@erudit-game.ru)
+SMTP_RELAY_SERVICE_FROM=               # Grafana alert From; the deploy derives a bare address for Grafana (it rejects "Name" <addr>)
 SERVICE_EMAIL=                         # Grafana alert recipient(s), comma-separated
 GRAFANA_SMTP_PORT=                     # Grafana STARTTLS port on SMTP_RELAY_HOST (Selectel: 1126)
 GF_SMTP_ENABLED=false                  # set true to enable Grafana alert emails
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 8efab5d..6bfe29c 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -509,7 +509,9 @@ services:
       GF_SMTP_HOST: ${SMTP_RELAY_HOST:-}:${GRAFANA_SMTP_PORT:-}
       GF_SMTP_USER: ${SMTP_RELAY_USER:-}
       GF_SMTP_PASSWORD: ${SMTP_RELAY_PASS:-}
-      GF_SMTP_FROM_ADDRESS: ${SMTP_RELAY_SERVICE_FROM:-}
+      # A BARE address (Grafana rejects the "Name" <addr> form); the deploy derives it from
+      # SMTP_RELAY_SERVICE_FROM, splitting off the display name into GRAFANA_SMTP_FROM_NAME.
+      GF_SMTP_FROM_ADDRESS: ${GRAFANA_SMTP_FROM_ADDRESS:-}
       GF_SMTP_FROM_NAME: ${GRAFANA_SMTP_FROM_NAME:-Erudit Alerts}
       GF_SMTP_STARTTLS_POLICY: MandatoryStartTLS
       # The alert recipient(s), read by the provisioned contact point via $__env{SERVICE_EMAIL}.