viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(authentik): SMTP host = mail.viktorbarzin.me (svc name fails wildcard-cert verify)
All checks were successful
ci/woodpecker/push/default Pipeline was successful
Details

Browse source 
The in-cluster svc name mailserver.mailserver.svc.cluster.local fails Authentik's strict STARTTLS hostname verification (CERTIFICATE_VERIFY_FAILED): the mailserver serves the *.viktorbarzin.me wildcard cert, which doesn't cover the svc DNS name. Use the public name mail.viktorbarzin.me, which resolves in-cluster (10.0.20.1) and matches the cert. Verified end-to-end from an authentik pod (verified TLS + SASL auth + send) before this change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-17 07:13:53 +00:00
parent c3d0c121bb
commit 4bf3f504ea
1 changed files with 17 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

27
stacks/authentik/modules/authentik/values.yaml
View file

@ -47,13 +47,19 @@ server:
value: "1800"
- name: AUTHENTIK_CACHE__TIMEOUT_POLICIES
value: "900"
# SMTP for signup verification + recovery email (tripit ADR-0020): send via
# the in-cluster mailserver as noreply@viktorbarzin.me (SASL, 587/STARTTLS);
# password from the authentik-email ExternalSecret (Vault
# secret/authentik.smtp_password). Set on server AND worker — the worker
# runs the email tasks, the server validates the Email stage config.
# SMTP for signup verification + recovery email (tripit ADR-0020): send as
# noreply@viktorbarzin.me (SASL, 587/STARTTLS); password from the
# authentik-email ExternalSecret (Vault secret/authentik.smtp_password). Set
# on server AND worker — the worker runs the email tasks, the server
# validates the Email stage config.
# HOST is the PUBLIC name mail.viktorbarzin.me, NOT the in-cluster svc
# (mailserver.mailserver.svc): the mailserver serves the *.viktorbarzin.me
# wildcard cert, which does not cover the svc DNS name, and Authentik
# verifies the STARTTLS hostname strictly (unlike most of our apps' SMTP
# clients) — the svc name fails CERTIFICATE_VERIFY_FAILED. mail.viktorbarzin.me
# resolves in-cluster (10.0.20.1) and matches the cert.
- name: AUTHENTIK_EMAIL__HOST
value: "mailserver.mailserver.svc.cluster.local"
value: "mail.viktorbarzin.me"
- name: AUTHENTIK_EMAIL__PORT
value: "587"
- name: AUTHENTIK_EMAIL__USE_TLS
@ -141,11 +147,12 @@ worker:
value: "1800"
- name: AUTHENTIK_CACHE__TIMEOUT_POLICIES
value: "900"
# SMTP (same as server.env) — the worker runs Authentik's email tasks, so it
# needs the transport too (tripit ADR-0020). noreply@viktorbarzin.me via the
# in-cluster mailserver; password from the authentik-email ExternalSecret.
# SMTP (same as server.env, incl. the mail.viktorbarzin.me-not-svc-name cert
# reason) — the worker runs Authentik's email tasks, so it needs the
# transport too (tripit ADR-0020). noreply@viktorbarzin.me; password from the
# authentik-email ExternalSecret.
- name: AUTHENTIK_EMAIL__HOST
value: "mailserver.mailserver.svc.cluster.local"
value: "mail.viktorbarzin.me"
- name: AUTHENTIK_EMAIL__PORT
value: "587"
- name: AUTHENTIK_EMAIL__USE_TLS