From edb08372461c243f1e302044a825c87c21c4f705 Mon Sep 17 00:00:00 2001 From: jklein Date: Sun, 23 Aug 2026 22:28:24 +0200 Subject: [PATCH] rallly: default smtp.rejectUnauthorized to true The deployment renders SMTP_REJECT_UNAUTHORIZED from rallly.smtp.rejectUnauthorized, but values.yaml never carried the key. With SMTP enabled the variable therefore reached the app as an empty string -- a certificate check nobody had configured either way. It now defaults to true, so the mail server's certificate is verified unless the operator switches the check off deliberately. values.yaml explains when that is needed (a mail server with a self-signed certificate), because the symptom otherwise points at the mail server rather than at this value. The env var is not rendered with "| default true": an explicit false is a zero value and default would swallow it, silently re-enabling the check the operator just switched off. A nil falls back to true instead, so the variable can no longer reach the app empty. The schema now rejects strings. Operationally inert: the rallly fleet bundle and the deployed release both have smtp.enabled: false, so the variable is not rendered at all -- the render with SMTP disabled is byte-identical to before. Major, because the runtime behaviour of mail sending changes. Fixes #109 --- rallly/Chart.yaml | 2 +- rallly/templates/rallly.deployment.yaml | 7 ++++++- rallly/values.schema.json | 4 ++-- rallly/values.yaml | 11 +++++++++++ 4 files changed, 20 insertions(+), 4 deletions(-) diff --git a/rallly/Chart.yaml b/rallly/Chart.yaml index 2aba2b7..15d8873 100644 --- a/rallly/Chart.yaml +++ b/rallly/Chart.yaml @@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/lukevella/rallly/main/apps/landing/publi type: application -version: 6.0.0+up4.12.3 +version: 7.0.0+up4.12.3 appVersion: "4.12.3" maintainers: diff --git a/rallly/templates/rallly.deployment.yaml b/rallly/templates/rallly.deployment.yaml index ac4dfdf..d4bec3a 100644 --- a/rallly/templates/rallly.deployment.yaml +++ b/rallly/templates/rallly.deployment.yaml @@ -73,7 +73,12 @@ spec: name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret key: password - name: SMTP_REJECT_UNAUTHORIZED - value: "{{ .Values.rallly.smtp.rejectUnauthorized }}" + {{- /* Not "| default true": an explicit false is a zero value, and + "default" would swallow it and silently re-enable the check + the operator just switched off. A nil (erased key) falls back + to the chart default true, so the variable can never reach + the app as an empty string (issues #109, #99). */}} + value: "{{ if kindIs "invalid" .Values.rallly.smtp.rejectUnauthorized }}true{{ else }}{{ .Values.rallly.smtp.rejectUnauthorized }}{{ end }}" - name: SMTP_TLS_SERVERNAME valueFrom: secretKeyRef: diff --git a/rallly/values.schema.json b/rallly/values.schema.json index 888a1e7..ed27e0e 100644 --- a/rallly/values.schema.json +++ b/rallly/values.schema.json @@ -46,8 +46,8 @@ "type": "boolean" }, "rejectUnauthorized": { - "description": "Passed to the app as SMTP_REJECT_UNAUTHORIZED. Read by the chart but deliberately without a default in values.yaml - see the note in the PR that introduced this schema.", - "type": ["boolean", "string", "null"] + "description": "Verify the mail server's TLS certificate; passed to the app as SMTP_REJECT_UNAUTHORIZED. Defaults to true (issue #109). Set false only for a mail server with a self-signed certificate. Strings are rejected: the env var is rendered from this value, and a string like \"yes\" would reach the app as a value it does not read as a boolean. Null means the chart default (true), as elsewhere in this chart (issue #99).", + "type": ["boolean", "null"] } } }, diff --git a/rallly/values.yaml b/rallly/values.yaml index 7786c95..afb1ced 100644 --- a/rallly/values.yaml +++ b/rallly/values.yaml @@ -16,6 +16,17 @@ rallly: replicas: 1 smtp: enabled: false + # Verify the mail server's TLS certificate (passed to the app as + # SMTP_REJECT_UNAUTHORIZED). Leave this at true. + # + # Set it to false ONLY for a mail server with a self-signed certificate. + # Without that hint the symptom is misleading: the send fails with a + # certificate error naming the mail server, so the search starts at the + # mail server or its CA chain rather than at this value. + # + # false disables the certificate check entirely and exposes the SMTP + # session to a man-in-the-middle; prefer trusting the CA over setting it. + rejectUnauthorized: true allowedEmails: '*' supportEmail: null oidc: