fix(deploy): Grafana SMTP reuses relay host + explicit GRAFANA_SMTP_PORT

Drop the separate GRAFANA_SMTP_HOST (it duplicated SMTP_RELAY_HOST): Grafana differs from
the backend only in needing the STARTTLS port, so GF_SMTP_HOST is composed from
SMTP_RELAY_HOST + GRAFANA_SMTP_PORT (an explicit per-contour var, no magic default), reusing
SMTP_RELAY_USER/PASS. Wired through ci/prod/.env.example/README.

.gitea/workflows/ci.yaml

@@ -347,7 +347,7 @@ jobs:
           ADMIN_EMAIL: ${{ vars.TEST_ADMIN_EMAIL }}
           SMTP_RELAY_SERVICE_FROM: ${{ vars.TEST_SMTP_RELAY_SERVICE_FROM }}
           SERVICE_EMAIL: ${{ vars.TEST_SERVICE_EMAIL }}
-          GRAFANA_SMTP_HOST: ${{ vars.TEST_GRAFANA_SMTP_HOST }}
+          GRAFANA_SMTP_PORT: ${{ vars.TEST_GRAFANA_SMTP_PORT }}
           GF_SMTP_ENABLED: ${{ vars.TEST_GF_SMTP_ENABLED }}
           # Canonical public origin for links in the email (this contour's URL);
           # required by the backend whenever SMTP_RELAY_HOST is set.

.gitea/workflows/prod-deploy.yaml

@@ -99,7 +99,7 @@ jobs:
       ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }}
       SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }}
       SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }}
-      GRAFANA_SMTP_HOST: ${{ vars.PROD_GRAFANA_SMTP_HOST }}
+      GRAFANA_SMTP_PORT: ${{ vars.PROD_GRAFANA_SMTP_PORT }}
       GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }}
       PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
       PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
@@ -168,7 +168,7 @@ jobs:
           export ADMIN_EMAIL='$ADMIN_EMAIL'
           export SMTP_RELAY_SERVICE_FROM='$SMTP_RELAY_SERVICE_FROM'
           export SERVICE_EMAIL='$SERVICE_EMAIL'
-          export GRAFANA_SMTP_HOST='$GRAFANA_SMTP_HOST'
+          export GRAFANA_SMTP_PORT='$GRAFANA_SMTP_PORT'
           export GF_SMTP_ENABLED='$GF_SMTP_ENABLED'
           export PUBLIC_BASE_URL='$PUBLIC_BASE_URL'
           export GATEWAY_ABUSE_BAN_ENABLED='true'

deploy/.env.example

@@ -47,13 +47,13 @@ PUBLIC_BASE_URL=                       # required when SMTP_RELAY_HOST is set (e
 
 # Operator alerts (email). The backend emails the admin on new feedback / word complaints
 # (coalesced), and Grafana emails infra alerts. Distinct senders; recipients may be several
-# comma-separated addresses. Grafana speaks STARTTLS, so it needs the relay's STARTTLS
+# comma-separated addresses. Grafana reuses SMTP_RELAY_HOST/USER/PASS but dials the STARTTLS
-# host:port (GRAFANA_SMTP_HOST) and reuses SMTP_RELAY_USER/PASS. All empty = alerts off.
+# port (it can't do the backend's implicit TLS), GRAFANA_SMTP_PORT. All empty = off.
 SMTP_RELAY_ADMIN_FROM=                 # backend admin-alert From (e.g. alerts@erudit-game.ru)
 ADMIN_EMAIL=                           # backend admin-alert recipient(s), comma-separated
 SMTP_RELAY_SERVICE_FROM=               # Grafana alert From (e.g. grafana@erudit-game.ru)
 SERVICE_EMAIL=                         # Grafana alert recipient(s), comma-separated
-GRAFANA_SMTP_HOST=                     # relay host:STARTTLS-port for Grafana (e.g. smtp.mail.selcloud.ru:1126)
+GRAFANA_SMTP_PORT=                     # Grafana STARTTLS port on SMTP_RELAY_HOST (Selectel: 1126)
 GF_SMTP_ENABLED=false                  # set true to enable Grafana alert emails
 
 # --- Edge / caddy -----------------------------------------------------------

deploy/README.md

@@ -107,7 +107,7 @@ without it Docker's resolver handles `otelcol`, `gateway` and `api.telegram.org`
 | `ADMIN_EMAIL` | variable | _(empty)_ | Backend operator-alert recipient(s); several comma-separated addresses allowed. |
 | `SMTP_RELAY_SERVICE_FROM` | variable | _(empty)_ | Grafana infra-alert sender address. |
 | `SERVICE_EMAIL` | variable | _(empty)_ | Grafana infra-alert recipient(s); comma-separated allowed (read by the provisioned contact point via `$__env{SERVICE_EMAIL}`). |
-| `GRAFANA_SMTP_HOST` | variable | _(empty)_ | Relay `host:port` on the **STARTTLS** port for Grafana (its client speaks STARTTLS, not the backend's implicit-TLS port), e.g. `smtp.mail.selcloud.ru:1126`. Reuses `SMTP_RELAY_USER`/`PASS`. |
+| `GRAFANA_SMTP_PORT` | variable | _(empty)_ | STARTTLS port Grafana dials on `SMTP_RELAY_HOST` (its client can't do the backend's implicit TLS), e.g. Selectel's `1126`. Reuses `SMTP_RELAY_HOST`/`USER`/`PASS`. |
 | `GF_SMTP_ENABLED` | variable | `false` | Set `true` to enable Grafana alert emails. |
 
 The six `VITE_*` are **build-args** baked into the gateway and landing images at
@@ -218,8 +218,8 @@ GRAFANA_ROOT_URL, LOG_LEVEL, DICT_VERSION, TELEGRAM_MINIAPP_URL, TELEGRAM_GAME_C
 TELEGRAM_CHAT_ID, TELEGRAM_BOT_USERNAME, VITE_TELEGRAM_BOT_ID, VITE_TELEGRAM_LINK,
 VITE_TELEGRAM_GAME_CHANNEL_NAME, VITE_VK_APP_LINK,
 SMTP_RELAY_HOST, SMTP_RELAY_PORT, SMTP_RELAY_TLS, SMTP_RELAY_FROM, PUBLIC_BASE_URL,
-SMTP_RELAY_ADMIN_FROM, ADMIN_EMAIL, SMTP_RELAY_SERVICE_FROM, SERVICE_EMAIL, GRAFANA_SMTP_HOST,
+SMTP_RELAY_ADMIN_FROM, ADMIN_EMAIL, SMTP_RELAY_SERVICE_FROM, SERVICE_EMAIL,
-GF_SMTP_ENABLED}`.
+GRAFANA_SMTP_PORT, GF_SMTP_ENABLED}`.
 
 ## Host-side setup (outside this repo)
 

deploy/docker-compose.yml

@@ -501,11 +501,12 @@ services:
       # caddy's Basic-Auth and re-prompts for the password on every dashboard; the
       # dashboards poll and do not need Live.
       GF_LIVE_MAX_CONNECTIONS: "0"
-      # SMTP for alert emails, reusing the shared relay credentials on its STARTTLS host:port
+      # SMTP for alert emails, reusing the shared relay host + credentials + the SERVICE
-      # (GRAFANA_SMTP_HOST — Grafana's client speaks STARTTLS, not the backend's implicit-TLS
+      # From/recipient. Grafana's client speaks STARTTLS (not the backend's implicit-TLS
-      # port), the SERVICE From, and the SERVICE recipient. Disabled unless GF_SMTP_ENABLED.
+      # port), so it dials the relay host on its STARTTLS port (GRAFANA_SMTP_PORT).
+      # Disabled unless GF_SMTP_ENABLED.
       GF_SMTP_ENABLED: ${GF_SMTP_ENABLED:-false}
-      GF_SMTP_HOST: ${GRAFANA_SMTP_HOST:-}
+      GF_SMTP_HOST: ${SMTP_RELAY_HOST:-}:${GRAFANA_SMTP_PORT:-}
       GF_SMTP_USER: ${SMTP_RELAY_USER:-}
       GF_SMTP_PASSWORD: ${SMTP_RELAY_PASS:-}
       GF_SMTP_FROM_ADDRESS: ${SMTP_RELAY_SERVICE_FROM:-}