fix(deploy): stage blackbox config + derive bare Grafana SMTP from-address

Two contour-deploy failures from PR4: (1) the deploy did not stage deploy/blackbox/, so
blackbox_exporter crash-looped on a missing config mount — add blackbox to the ci.yaml cp
and the prod-deploy tar; (2) Grafana rejects the 'Name <addr>' From form the backend go-mail
accepts and validates it even when SMTP is disabled, crash-looping Grafana — the deploy now
splits SMTP_RELAY_SERVICE_FROM into a bare GF_SMTP_FROM_ADDRESS + GRAFANA_SMTP_FROM_NAME
(handles both display and bare forms). Verified the sed split + compose render.

.gitea/workflows/ci.yaml

@@ -384,8 +384,20 @@ jobs:
           conf="$HOME/.scrabble-deploy"
           rm -rf "$conf"
           mkdir -p "$conf"
-          cp -r caddy otelcol prometheus tempo grafana "$conf"/
+          cp -r caddy otelcol prometheus tempo grafana blackbox "$conf"/
           export SCRABBLE_CONFIG_DIR="$conf"
+          # Grafana's SMTP from_address must be a BARE address (it rejects the "Name" <addr>
+          # form the backend go-mail accepts) and validates it even when SMTP is disabled — a
+          # bad value crash-loops Grafana. Split the display-format SERVICE From into a bare
+          # address + name for Grafana; the backend keeps the full form.
+          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
+          case "$svc_from" in
+            *"<"*">"*)
+              export GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
+              export GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
+            *)
+              export GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
+          esac
           # Bot-link mTLS material for the test contour: a private CA + gateway/bot
           # leaves (CN=gateway, the service name the bot dials). Prod supplies these
           # from PROD_ secrets instead. Regenerated each deploy; both ends redeploy

.gitea/workflows/prod-deploy.yaml

@@ -140,6 +140,16 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-main
+          # Grafana needs a BARE from-address (it rejects the "Name" <addr> form the backend
+          # accepts, and validates it even when disabled); split the display-format here.
+          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
+          GRAFANA_SMTP_FROM_NAME=''
+          case "$svc_from" in
+            *"<"*">"*)
+              GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
+              GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
+            *) GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
+          esac
           cat > stage/env.sh <<EOF
           export REGISTRY='$REGISTRY'
           export SCRABBLE_CONFIG_DIR='/opt/scrabble'
@@ -167,6 +177,8 @@ jobs:
           export SMTP_RELAY_ADMIN_FROM='$SMTP_RELAY_ADMIN_FROM'
           export ADMIN_EMAIL='$ADMIN_EMAIL'
           export SMTP_RELAY_SERVICE_FROM='$SMTP_RELAY_SERVICE_FROM'
+          export GRAFANA_SMTP_FROM_ADDRESS='$GRAFANA_SMTP_FROM_ADDRESS'
+          export GRAFANA_SMTP_FROM_NAME='$GRAFANA_SMTP_FROM_NAME'
           export SERVICE_EMAIL='$SERVICE_EMAIL'
           export GRAFANA_SMTP_PORT='$GRAFANA_SMTP_PORT'
           export GF_SMTP_ENABLED='$GF_SMTP_ENABLED'
@@ -183,7 +195,7 @@ jobs:
           ssh_main 'mkdir -p /opt/scrabble/compose'
           tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
             | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C deploy -czf - caddy otelcol prometheus tempo grafana \
+          tar -C deploy -czf - caddy otelcol prometheus tempo grafana blackbox \
             | ssh_main 'tar -C /opt/scrabble -xzf -'
           tar -C stage -czf - certs-main \
             | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'

deploy/.env.example

@@ -51,7 +51,7 @@ PUBLIC_BASE_URL=                       # required when SMTP_RELAY_HOST is set (e
 # port (it can't do the backend's implicit TLS), GRAFANA_SMTP_PORT. All empty = off.
 SMTP_RELAY_ADMIN_FROM=                 # backend admin-alert From (e.g. alerts@erudit-game.ru)
 ADMIN_EMAIL=                           # backend admin-alert recipient(s), comma-separated
-SMTP_RELAY_SERVICE_FROM=               # Grafana alert From (e.g. grafana@erudit-game.ru)
+SMTP_RELAY_SERVICE_FROM=               # Grafana alert From; the deploy derives a bare address for Grafana (it rejects "Name" <addr>)
 SERVICE_EMAIL=                         # Grafana alert recipient(s), comma-separated
 GRAFANA_SMTP_PORT=                     # Grafana STARTTLS port on SMTP_RELAY_HOST (Selectel: 1126)
 GF_SMTP_ENABLED=false                  # set true to enable Grafana alert emails

deploy/docker-compose.yml

@@ -509,7 +509,9 @@ services:
       GF_SMTP_HOST: ${SMTP_RELAY_HOST:-}:${GRAFANA_SMTP_PORT:-}
       GF_SMTP_USER: ${SMTP_RELAY_USER:-}
       GF_SMTP_PASSWORD: ${SMTP_RELAY_PASS:-}
-      GF_SMTP_FROM_ADDRESS: ${SMTP_RELAY_SERVICE_FROM:-}
+      # A BARE address (Grafana rejects the "Name" <addr> form); the deploy derives it from
+      # SMTP_RELAY_SERVICE_FROM, splitting off the display name into GRAFANA_SMTP_FROM_NAME.
+      GF_SMTP_FROM_ADDRESS: ${GRAFANA_SMTP_FROM_ADDRESS:-}
       GF_SMTP_FROM_NAME: ${GRAFANA_SMTP_FROM_NAME:-Erudit Alerts}
       GF_SMTP_STARTTLS_POLICY: MandatoryStartTLS
       # The alert recipient(s), read by the provisioned contact point via $__env{SERVICE_EMAIL}.