From ec1bdfca00cd2ef0214a862c0ceb04380217d47e Mon Sep 17 00:00:00 2001 From: Ilia Denisov Date: Fri, 3 Jul 2026 15:17:43 +0200 Subject: [PATCH] fix(deploy): Grafana SMTP reuses relay host + explicit GRAFANA_SMTP_PORT Drop the separate GRAFANA_SMTP_HOST (it duplicated SMTP_RELAY_HOST): Grafana differs from the backend only in needing the STARTTLS port, so GF_SMTP_HOST is composed from SMTP_RELAY_HOST + GRAFANA_SMTP_PORT (an explicit per-contour var, no magic default), reusing SMTP_RELAY_USER/PASS. Wired through ci/prod/.env.example/README. --- .gitea/workflows/ci.yaml | 2 +- .gitea/workflows/prod-deploy.yaml | 4 ++-- deploy/.env.example | 6 +++--- deploy/README.md | 6 +++--- deploy/docker-compose.yml | 9 +++++---- 5 files changed, 14 insertions(+), 13 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index ae8aaf0..698f619 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -347,7 +347,7 @@ jobs: ADMIN_EMAIL: ${{ vars.TEST_ADMIN_EMAIL }} SMTP_RELAY_SERVICE_FROM: ${{ vars.TEST_SMTP_RELAY_SERVICE_FROM }} SERVICE_EMAIL: ${{ vars.TEST_SERVICE_EMAIL }} - GRAFANA_SMTP_HOST: ${{ vars.TEST_GRAFANA_SMTP_HOST }} + GRAFANA_SMTP_PORT: ${{ vars.TEST_GRAFANA_SMTP_PORT }} GF_SMTP_ENABLED: ${{ vars.TEST_GF_SMTP_ENABLED }} # Canonical public origin for links in the email (this contour's URL); # required by the backend whenever SMTP_RELAY_HOST is set. diff --git a/.gitea/workflows/prod-deploy.yaml b/.gitea/workflows/prod-deploy.yaml index 0a9aac1..0d76345 100644 --- a/.gitea/workflows/prod-deploy.yaml +++ b/.gitea/workflows/prod-deploy.yaml @@ -99,7 +99,7 @@ jobs: ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }} SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }} SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }} - GRAFANA_SMTP_HOST: ${{ vars.PROD_GRAFANA_SMTP_HOST }} + GRAFANA_SMTP_PORT: ${{ vars.PROD_GRAFANA_SMTP_PORT }} GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }} PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }} PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }} @@ -168,7 +168,7 @@ jobs: export ADMIN_EMAIL='$ADMIN_EMAIL' export SMTP_RELAY_SERVICE_FROM='$SMTP_RELAY_SERVICE_FROM' export SERVICE_EMAIL='$SERVICE_EMAIL' - export GRAFANA_SMTP_HOST='$GRAFANA_SMTP_HOST' + export GRAFANA_SMTP_PORT='$GRAFANA_SMTP_PORT' export GF_SMTP_ENABLED='$GF_SMTP_ENABLED' export PUBLIC_BASE_URL='$PUBLIC_BASE_URL' export GATEWAY_ABUSE_BAN_ENABLED='true' diff --git a/deploy/.env.example b/deploy/.env.example index 74a3fbf..c646e60 100644 --- a/deploy/.env.example +++ b/deploy/.env.example @@ -47,13 +47,13 @@ PUBLIC_BASE_URL= # required when SMTP_RELAY_HOST is set (e # Operator alerts (email). The backend emails the admin on new feedback / word complaints # (coalesced), and Grafana emails infra alerts. Distinct senders; recipients may be several -# comma-separated addresses. Grafana speaks STARTTLS, so it needs the relay's STARTTLS -# host:port (GRAFANA_SMTP_HOST) and reuses SMTP_RELAY_USER/PASS. All empty = alerts off. +# comma-separated addresses. Grafana reuses SMTP_RELAY_HOST/USER/PASS but dials the STARTTLS +# port (it can't do the backend's implicit TLS), GRAFANA_SMTP_PORT. All empty = off. SMTP_RELAY_ADMIN_FROM= # backend admin-alert From (e.g. alerts@erudit-game.ru) ADMIN_EMAIL= # backend admin-alert recipient(s), comma-separated SMTP_RELAY_SERVICE_FROM= # Grafana alert From (e.g. grafana@erudit-game.ru) SERVICE_EMAIL= # Grafana alert recipient(s), comma-separated -GRAFANA_SMTP_HOST= # relay host:STARTTLS-port for Grafana (e.g. smtp.mail.selcloud.ru:1126) +GRAFANA_SMTP_PORT= # Grafana STARTTLS port on SMTP_RELAY_HOST (Selectel: 1126) GF_SMTP_ENABLED=false # set true to enable Grafana alert emails # --- Edge / caddy ----------------------------------------------------------- diff --git a/deploy/README.md b/deploy/README.md index e259d9c..408f2f2 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -107,7 +107,7 @@ without it Docker's resolver handles `otelcol`, `gateway` and `api.telegram.org` | `ADMIN_EMAIL` | variable | _(empty)_ | Backend operator-alert recipient(s); several comma-separated addresses allowed. | | `SMTP_RELAY_SERVICE_FROM` | variable | _(empty)_ | Grafana infra-alert sender address. | | `SERVICE_EMAIL` | variable | _(empty)_ | Grafana infra-alert recipient(s); comma-separated allowed (read by the provisioned contact point via `$__env{SERVICE_EMAIL}`). | -| `GRAFANA_SMTP_HOST` | variable | _(empty)_ | Relay `host:port` on the **STARTTLS** port for Grafana (its client speaks STARTTLS, not the backend's implicit-TLS port), e.g. `smtp.mail.selcloud.ru:1126`. Reuses `SMTP_RELAY_USER`/`PASS`. | +| `GRAFANA_SMTP_PORT` | variable | _(empty)_ | STARTTLS port Grafana dials on `SMTP_RELAY_HOST` (its client can't do the backend's implicit TLS), e.g. Selectel's `1126`. Reuses `SMTP_RELAY_HOST`/`USER`/`PASS`. | | `GF_SMTP_ENABLED` | variable | `false` | Set `true` to enable Grafana alert emails. | The six `VITE_*` are **build-args** baked into the gateway and landing images at @@ -218,8 +218,8 @@ GRAFANA_ROOT_URL, LOG_LEVEL, DICT_VERSION, TELEGRAM_MINIAPP_URL, TELEGRAM_GAME_C TELEGRAM_CHAT_ID, TELEGRAM_BOT_USERNAME, VITE_TELEGRAM_BOT_ID, VITE_TELEGRAM_LINK, VITE_TELEGRAM_GAME_CHANNEL_NAME, VITE_VK_APP_LINK, SMTP_RELAY_HOST, SMTP_RELAY_PORT, SMTP_RELAY_TLS, SMTP_RELAY_FROM, PUBLIC_BASE_URL, -SMTP_RELAY_ADMIN_FROM, ADMIN_EMAIL, SMTP_RELAY_SERVICE_FROM, SERVICE_EMAIL, GRAFANA_SMTP_HOST, -GF_SMTP_ENABLED}`. +SMTP_RELAY_ADMIN_FROM, ADMIN_EMAIL, SMTP_RELAY_SERVICE_FROM, SERVICE_EMAIL, +GRAFANA_SMTP_PORT, GF_SMTP_ENABLED}`. ## Host-side setup (outside this repo) diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index ef116e2..8efab5d 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -501,11 +501,12 @@ services: # caddy's Basic-Auth and re-prompts for the password on every dashboard; the # dashboards poll and do not need Live. GF_LIVE_MAX_CONNECTIONS: "0" - # SMTP for alert emails, reusing the shared relay credentials on its STARTTLS host:port - # (GRAFANA_SMTP_HOST — Grafana's client speaks STARTTLS, not the backend's implicit-TLS - # port), the SERVICE From, and the SERVICE recipient. Disabled unless GF_SMTP_ENABLED. + # SMTP for alert emails, reusing the shared relay host + credentials + the SERVICE + # From/recipient. Grafana's client speaks STARTTLS (not the backend's implicit-TLS + # port), so it dials the relay host on its STARTTLS port (GRAFANA_SMTP_PORT). + # Disabled unless GF_SMTP_ENABLED. GF_SMTP_ENABLED: ${GF_SMTP_ENABLED:-false} - GF_SMTP_HOST: ${GRAFANA_SMTP_HOST:-} + GF_SMTP_HOST: ${SMTP_RELAY_HOST:-}:${GRAFANA_SMTP_PORT:-} GF_SMTP_USER: ${SMTP_RELAY_USER:-} GF_SMTP_PASSWORD: ${SMTP_RELAY_PASS:-} GF_SMTP_FROM_ADDRESS: ${SMTP_RELAY_SERVICE_FROM:-}