Self hosting: NetworkMode causing problem with email?

[gilgongo]

EDIT: see my comment here too.

---

Hi - I'm running the docker image on an Ubuntu 22.04 machine with Postfix, but Rallly can't send mail. I'm also running Discourse on the same machine, and Discourse is sending mail out successfully using SMTP from its container in a similar way to Rallly.

The Rallly container can see the mail server (when I connect to it with docker exec -it rallly-rallly-1 /bin/bash):

nextjs@3123c70d01fa:/app$ getent hosts smtp.mymailserv.com
2001:xxx:x:xxxx::xx mail.mymailserv.com smtp.mymailserv.com

But when I try to connect from the container with:

openssl s_client -connect smtp.mymailserv.com:587 -starttls smtp

If I try that from within the Discourse container, it connects and comes back with the relevant handshake.

When I run docker logs rallly-rallly-1 I see:

Prisma schema loaded from prisma/schema.prisma
Datasource "db": PostgreSQL database "db", schema "public" at "rallly_db:5432"

50 migrations found in prisma/migrations

No pending migrations to apply.
   ▲ Next.js 14.0.4
   - Local:        http://localhost:3000
   - Network:      http://0.0.0.0:3000

Error sending email Error: Connection timeout
    at SMTPConnection._formatError (/app/node_modules/nodemailer/lib/smtp-connection/index.js:790:19)
    at SMTPConnection._onError (/app/node_modules/nodemailer/lib/smtp-connection/index.js:776:20)
    at Timeout.<anonymous> (/app/node_modules/nodemailer/lib/smtp-connection/index.js:235:22)
    at listOnTimeout (node:internal/timers:569:17)
    at process.processTimers (node:internal/timers:512:7) {
  code: 'ETIMEDOUT',
  command: 'CONN'
}

Does anyone have any tips on how to troubleshoot this? My Rallly config is:

SMTP_HOST=smtp.mymailserv.com
SMTP_PORT=587
SMTP_SECURE=
SMTP_USER=xxxx
SMTP_PWD=xxxx
SMTP_TLS_ENABLED=true

My postfix listener on port 587 is configured as follows:

submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_key_file=/etc/letsencrypt/live/mtp.mymailserv.com/privkey.pem
  -o smtpd_tls_cert_file=/etc/letsencrypt/live/mtp.mymailserv.com/fullchain.pem
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

If I send a test mail from the host using Rallly's login, it works fine. Why can't Rallly send mail in the same way?

Any help appreciated.

[nbruneau71250]

Hi,

I have the same issue, did you solve it ?

Nicolas

[gilgongo]

Unfortunately not. My Discourse docker container happily sends out hundreds of emails a day via its SMTP settings, while Rallly times out. So I'm forced to assume it's something about Rallly. If anyone else has it working, it would be great to see how they're doing it.

BTW when I changed the postfix entry for $mynetworks from 172.17.0.0/16 to 172.0.0.0/8 it let a spammer in. So maybe don't do that :-)

[nbruneau71250]

Hey I did it

…

On Fri, Jun 21, 2024, 15:46 Jonathan ***@***.***> wrote: Unfortunately not. My Discourse docker container happily sends out hundreds of emails a day via its SMTP settings, while Rallly times out. So I'm forced to assume it's something about Rallly. If anyone else has it working, it would be great to see how they're doing it. BTW when I changed the postfix entry for $mynetworks from 172.17.0.0/16 to 172.0.0.0/8 it let a spammer in. So maybe don't do that :-) — Reply to this email directly, view it on GitHub <#1092 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANAXWUCDLZ6SMSHXECGKRO3ZIQVC3AVCNFSM6AAAAABHPD7UVOVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TQNBQGIZDK> . You are receiving this because you commented.Message ID: ***@***.***>

[gilgongo]

Any idea how?

[nbruneau71250]

So, to make it work I added the variable SMTP_TLS_ENABLED to true and I disable the variable SMTP_SECURE (false).
Then, i kept the paramaters.

Hope this will help.

[gilgongo]

Thanks - although that's what I'm doing. I think this must be some firewall issue or something. I'll have to keep looking.

[gilgongo]

I think I've found a clue.

Rallly's network config seems to be a custom, user-defined network: "NetworkMode": "rallly_default",. If I compare that to the Discourse container, it's just using "NetworkMode": "bridge", and is working to send mail out.

Is there something about the fact that Rallly's using its own network config and not a bridge configuration that's leading to this problem? It also may be relevant that my mail server is not listening on the same interface as the web server is (there are two IP addresses on the machine, and Rallly's web UI is working fine).

Perhaps Rallly's not working with multi-homed systems? If I ping what the Docker container gives for the Gateway address, it resolves to the hostname of the web server, not the IP the mail server listens on. When I do that inside the Discourse container, it returns nothing (not sure what that means...)

Rallly:

nextjs@ff866ea6c960:/app$ getent hosts 172.18.0.1
172.17.0.1      www.mydomain.com

Discourse:

root@alice-app:/# getent hosts 172.18.0.1
root@alice-app:/#

EDIT: I've just installed Rallly on a VM using the same config as I have on my production server and it works. So this does seem likely it's a multi-homing problem.

[gilgongo]

Opening up inbound port 587 on all interfaces cures the problem. This is I think because the docker compose file causes the container to create a new interface (called br-36bedc370406, but I think that changes each time its started) which the firewall didn't know about. I had previously only had all traffic open on docker0.