Send invitations and notices through an SMTP relay.
Harthelm sends four kinds of mail: an invitation to an organization or team, a "you were added" notice when an admin adds an existing user, a break-glass notice when someone signs in with the emergency account, and licence reminders to the cluster admins before the licence ends (Licence). All go through one SMTP relay you configure.
Without a relay, mail is off: nothing is queued, and the console shows each invitation's link once so an admin can pass it on.
Configure a relay
kubectl -n harthelm-system create secret generic smtp-login \
--from-literal=username=<user> --from-literal=password=<password>mail:
smtp: {host: smtp.example.com, port: 587, tls: starttls, existingSecret: smtp-login}
from: [email protected]
fromName: Harthelm
breakGlassTo: [email protected]
networkPolicy:
egress:
smtp: {to: [{ipBlock: {cidr: 192.0.2.25/32}}]}| Value | Meaning |
|---|---|
mail.smtp.host, mail.smtp.port | The relay; the port defaults to 587. Empty host: mail is off. |
mail.smtp.tls | starttls (default): encrypt when the relay offers it, and required with a login. tls: implicit TLS, port 465. none: plain, refused with a login. |
mail.smtp.existingSecret | An optional login, keys mail.smtp.usernameKey and mail.smtp.passwordKey (username, password). |
mail.from, mail.fromName | The sender. Required with a relay. |
mail.language | en (default) or de. |
mail.perSenderPerHour | Mails one person may cause per hour, default 20. Over it, the API answers 429. |
mail.breakGlassTo | Who gets break-glass notices; empty: nobody. |
mail.retention | Sent mails are kept 30 days, failed ones 90. |
networkPolicy.egress.smtp | Where core may connect; the port defaults to the relay's. |
A relay certificate from a private CA is not supported yet: the connection fails and the mail is retried.
Delivery
Mails are queued in the database in the same transaction as what they announce, then sent by core:
- A relay that is down only delays mail: core retries with backoff up to 25 times, about two and a half hours.
- A permanent refusal (a 5xx reply) fails the mail at once.
- Delivery is at least once: after a crash a mail can go out twice. A duplicate invitation carries the same link.
- The invitation link in a queued mail is sealed with the master key and cleared once the mail is sent or given up, so a database dump holds no usable link.
The members page shows each invitation's mail as sent or failed. Harthelm does not see bounces: a mail the relay accepted and the next hop refused looks sent.
Check
hart admin doctorThe mail check says whether the relay answers.