Customizing an app's email-address with new "resources" app-install-system?

Discuss Advanced use case
,
1

The email addresses allowed for older apps that use regular user-accounts seem to just be in yunohost user list --fields mail-alias, and configurable just as regular users.

However, for the new “resources system” I found the documentation for configuring a system-user in the manifest, but did not find any manual commands to modify the mail_user and mail_domain properties.

How can admins override the packager’s choice, in order to allow to (manually) configure the app to send email using a custom email address?

2

What are the apps?

What custom email address do you want?

3

When using a whole subdomain for an app I’d like to configure e.g. something@domain.tld instead of the default something like <app>@<app>.domain.tld.

Was able to configure the desired address in an app, but yunohost then errors with

Sender address rejected: not owned by user <app>

So, I guess I’d have to modify the default [resources.system_user] mail_user and mail_domain (regardless if it was specified in the shipped app manifest or not), setting it with some local yunohost command.

4

This is confusing. I don’t understand why using the main domain email for an app running on a subdomain.
You can create a dummy account in YunoHost only for emails and use it for your app. This will probably require you to update the app config on every update.
Or you can simply change the config of the app to use localhost as mail domain, but you will have to disable encryption and use port 25. In this case, no need for password. But some email providers will reject these emails.
Without having full view of the situation, I would recommend creating a dummy account for email

5

Thanks for pointing out to use an alternative sending method or account.

Unfortunately, even if it were accepted remotely one can’t really use @localhost as mail domain reliably, because any reply or bounce would break the dovecot maildir (“Issue D” from Issues to fix email breakages caused by upgrades (regression)) (Sorry, not relevant for sending-only, but using the @localhost domain is generally not accepted remotely anyway, though.)

Also unfortunately, using the real account login requires to make the account password available to the app, which isn’t very good for separation and security.

So the separation is still where the app’s resources.system_user really shines.

And it would be great if the new resources system could also be configured locally somehow with mail_user and mail_domain overrides, similar to the old yunohost user update --add-mailalias.

6

Another difference would probably be that, unlike a real or fake user account, the resources.system_user account is a “no-reply” address. No mailbox, and incomming email properly rejected with “unknown user”.

7

You don’t use @localhost email, but for ex noreply@yourdomain but in the app config the mail host can be localhost
For ex

MAIL_DRIVER=smtp
MAIL_HOST=localhost
MAIL_PORT=25
MAIL_USERNAME=__APP__
MAIL_PASSWORD=__MAIL_PWD__
MAIL_ENCRYPTION=false
MAIL_FROM_NAME=lychee
MAIL_FROM_ADDRESS=noreply@__DOMAIN__

Instead of

MAIL_DRIVER=smtp
MAIL_HOST=__DOMAIN__
MAIL_PORT=587
MAIL_USERNAME=__APP__
MAIL_PASSWORD=__MAIL_PWD__
MAIL_ENCRYPTION=true
MAIL_FROM_NAME=lychee
MAIL_FROM_ADDRESS=__APP__@__DOMAIN__

Using MAIL_HOST=localhost doesn’t require password even if in this example the password is defined, because localhost is trusted.

8

Ah, ok, you meant localhost as SMTP server.

Will try that. Why did you think email providers would reject these emails at the remote end?

9

I don’t think, I know it :grimacing:. Because I faced the issue of emails rejected, I don’t remember the error message but it said that the sender was not authenticated.

10

Found it’s simple to properly customize the email sending address of a system user account that an app has configured as a “resource” in its manifest:

yunohost app setting <APP> mail_user -v 'name'
yunohost app setting admidio mail_domain -v 'domain.example.org'

yunohost tools regen-conf postfix
# check:
cat /etc/postfix/app_senders_login_maps

yunohost tools regen-conf dovecot
# check:
cat /etc/dovecot/app-senders-passwd

If receiving emails is also desired, that address can simply be configured as an alias for an existing user (mailbox).

If a yunohost app package re-generates (overwrites) your entire local configuration file on upgrades, that package may at least have to be adjusted to use __MAIL_USER__ and __MAIL_DOMAIN__ in the template to configure email (instead of __APP__ and __DOMAIN__, but as I don’t have any such app installed I can’t confirm that for sure.