Usa Protonmail Bridge con Discourse

Wiki della community Amministratori di sistema
1

Problema: a) Protonmail Bridge non può ascoltare su IP diversi da 127.0.0.1, e b) Discourse in un container Docker non può inviare richieste SMTP a 127.0.0.1 della macchina host.

Soluzione: Lo configuriamo per inviare a 172.17.0.1 (l’IP del bridge di Docker sulla macchina host) e poi reindirizzare a 127.0.0.1, su cui è in ascolto Protonmail Bridge.

Lo facciamo usando Socat.

Come Fare

Inizia installando Socat:
apt install socat

Eseguiremo Socat come servizio. Crea il file di servizio:
nano /etc/systemd/system/protonsocat.service

… e inserisci il seguente contenuto:

[Unit]
Description=Socat Bridge ProtonMail/Discourse
After=protonbridge.service,docker.service
ReloadPropagatedFrom=docker.service

[Service]
ExecStart=socat -d -d -lm TCP4-LISTEN:1026,fork,reuseaddr,so-bindtodevice=docker0,range=172.17.0.0/24 TCP4:127.0.0.1:1025
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target

Note:

  • Abbiamo configurato Socat per ascoltare su tutti gli IP 172.17.0.0/24, porta 1026, e reindirizzare il traffico a 127.0.0.1:1025, dove è in ascolto Protonmail Bridge.

  • Esempio dalla documentazione di Socat: socat

  • -d -d stamperà i messaggi fatali, di errore, di avviso e di notifica; potresti non volere così tanti dettagli registrati.

Successivamente, avvia il servizio:
systemctl start protonsocat

Verifica che sia in esecuzione:
systemctl status protonsocat

E configuralo per avviarsi automaticamente all’avvio:
systemctl enable protonsocat

Fatto! Ora, configura Discourse app.yml e ricostruisci:

  DISCOURSE_SMTP_ADDRESS: 172.17.0.1
  DISCOURSE_SMTP_PORT: 1026
  DISCOURSE_SMTP_USER_NAME: <nome utente SMTP fornito dall'applicazione da riga di comando di Proton Bridge>
  DISCOURSE_SMTP_PASSWORD: "<password SMTP - metti tra virgolette>"
  DISCOURSE_SMTP_ENABLE_START_TLS: true
  DISCOURSE_SMTP_DOMAIN: <il nome del dominio>
  DISCOURSE_NOTIFICATION_EMAIL: <qui, metti l'indirizzo da cui Discourse invierà le email transazionali>
2 Mi Piace
2

Ciao @meglio
Non riesco a trovare protonbridge.service quindi l’ho sostituito con protonmail.service
Ma sembra che ci sia un problema con il formato After=protonbridge.service,docker.service

4

Ciao @meglio Questo sembra darmi un errore

Dopo i comandi sysctl iniziali

root@ip-172-31-0-166:/var/discourse# systemctl status protonsocat.service
● protonsocat.service - Socat Bridge ProtonMail/Discourse
     Loaded: loaded (/etc/systemd/system/protonsocat.service; enabled; vendor preset: enabled)
     Active: active (running) since dom 2022-12-18 20:58:18 UTC; 25s ago
   Main PID: 2020962 (socat)
      Tasks: 1 (limit: 1143)
     Memory: 2.0M
        CPU: 4ms
     CGroup: /system.slice/protonsocat.service
             └─2020962 socat -d -d -lm TCP4-LISTEN:1026,fork,reuseaddr,so-bindtodevice=docker0,range=172.17.0.0/24 TCP4:127.0.0.1:1025

Dec 18 20:58:18 ip-172-31-0-166 systemd[1]: Started Socat Bridge ProtonMail/Discourse.
Dec 18 20:58:18 ip-172-31-0-166 socat[2020962]: 2022/12/18 20:58:18 socat[2020962] W ioctl(5, IOCTL_VM_SOCKETS_GET_LOCAL_CID, ...): Inappropriate ioctl for device
Dec 18 20:58:18 ip-172-31-0-166 socat[2020962]: N listening on AF=2 0.0.0.0:1026
**Dec 18 20:58:42 ip-172-31-0-166 systemd[1]: /etc/systemd/system/protonsocat.service:3: Failed to add dependency on protonbridge.service,docker.service, ignoring: Invalid argument**

Inoltre, quando eseguo ./discourse-doctor, ricevo un errore come


==================== TEST MAIL ====================
Per un test robusto, ottieni un indirizzo da http://www.mail-tester.com/
Oppure invia semplicemente un messaggio di prova a te stesso.
Indirizzo email per il test di posta? ('n' per saltare) [[REDACTED]@proton.me]:
Invio mail a [REDACTED]@proton.me. . .
SAM: sudo docker exec -w /var/www/discourse -i app rake emails:test[[REDACTED]@proton.me]
Test invio a [REDACTED]@proton.me usando 172.17.0.1:1026, username:[REDACTED]@proton.me con autenticazione plain.
======================================== ERRORE ========================================
                                    ERRORE IMPREVISTO

**fine del file raggiunto**

====================================== SOLUZIONE =======================================
Questo non è un errore comune. Non esiste una soluzione raccomandata!

Si prega di segnalare il messaggio di errore esatto sopra a https://meta.discourse.org/
(E una soluzione, se ne trovi una!)

Qualsiasi suggerimento sarebbe apprezzato e utile!
Grazie.

5

Siete riusciti a risolvere quei problemi da allora?

6

Ho in realtà un problema peggiore, il mio socat funziona bene, ma non riesco a connettermi a telnet 172.17.0.1 1026 o 172.17.0.2 1026. Ho anche provato 127.0.0.1 1026 e 1025, tutti falliti dall’interno del container Docker con Discourse.

Posso connettermi con telnet senza problemi sulla macchina host con 127.0.0.1 1025, Discourse ha cambiato qualcosa?

root@raspberry:/var/discourse# sudo systemctl status protonsocat.service 
● protonsocat.service - Socat Bridge ProtonMail/Discourse
     Loaded: loaded (/etc/systemd/system/protonsocat.service; enabled; vendor preset: enabled)
     Active: active (running) since Sat 2023-02-25 20:37:34 CET; 4min 37s ago
   Main PID: 1530542 (socat)
      Tasks: 1 (limit: 9236)
     Memory: 816.0K
        CPU: 10ms
     CGroup: /system.slice/protonsocat.service
             └─1530542 socat -d -d -lm TCP4-LISTEN:1026,fork,reuseaddr,so-bindtodevice=docker0,range=172.17.0.0/24 TCP4:127.0.0.1:1025

Feb 25 20:37:34 raspberry.local systemd[1]: Started Socat Bridge ProtonMail/Discourse.
Feb 25 20:37:34 raspberry.local socat[1530542]: 2023/02/25 20:37:34 socat[1530542] W ioctl(5, IOCTL_VM_SOCKETS_GET_LOCAL_CID, ...): Inappropriate ioctl for device
Feb 25 20:37:34 raspberry.local socat[1530542]: N listening on AF=2 0.0.0.0:1026

Macchina host:

root@raspberry:/var/discourse# telnet 127.0.0.1 1025
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 127.0.0.1 ESMTP Service Ready

root@raspberry:/var/discourse# nmap 127.0.0.1 1025
Starting Nmap 7.80 ( https://nmap.org ) at 2023-02-25 21:03 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000045s latency).
Not shown: 993 closed ports
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
1025/tcp open  NFS-or-IIS
3306/tcp open  mysql
5432/tcp open  postgresql
8080/tcp open  http-proxy
8088/tcp open  radan-http

Nmap done: 2 IP addresses (1 host up) scanned in 3.36 seconds

Le mie interfacce sulla macchina host:

root@raspberry:/var/discourse# ifconfig
br-eb8fd6a0d930: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.18.0.1  netmask 255.255.0.0  broadcast 172.18.255.255
        inet6 fe80::42:bdff:fe5c:8dbf  prefixlen 64  scopeid 0x20<link>
        ether 02:42:bd:5c:8d:bf  txqueuelen 0  (Ethernet)
        RX packets 1336  bytes 94913 (94.9 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2254  bytes 3098019 (3.0 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 fe80::42:60ff:feaf:784c  prefixlen 64  scopeid 0x20<link>
        ether 02:42:60:af:78:4c  txqueuelen 0  (Ethernet)
        RX packets 295920  bytes 21547471 (21.5 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1049936  bytes 1487623390 (1.4 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether dc:a6:32:c2:70:f8  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 97179  bytes 22606251 (22.6 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 97179  bytes 22606251 (22.6 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth5a26573: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::428:bfff:febf:cf5c  prefixlen 64  scopeid 0x20<link>
        ether 06:28:bf:bf:cf:5c  txqueuelen 0  (Ethernet)
        RX packets 1336  bytes 113617 (113.6 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2279  bytes 3099825 (3.0 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vethe0f8588: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::a04d:adff:feb1:351a  prefixlen 64  scopeid 0x20<link>
        ether a2:4d:ad:b1:35:1a  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 32  bytes 2488 (2.4 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vethfe706a1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::74b3:3aff:feea:89ec  prefixlen 64  scopeid 0x20<link>
        ether 76:b3:3a:ea:89:ec  txqueuelen 0  (Ethernet)
        RX packets 4459  bytes 287499 (287.4 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5221  bytes 7330834 (7.3 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.0.4  netmask 255.255.255.0  broadcast 10.0.0.255
        inet6 fe80::dea6:32ff:fec2:70f9  prefixlen 64  scopeid 0x20<link>
        ether dc:a6:32:c2:70:f9  txqueuelen 1000  (Ethernet)
        RX packets 2789702  bytes 3447696344 (3.4 GB)
        RX errors 0  dropped 7  overruns 0  frame 0
        TX packets 1082661  bytes 213831559 (213.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Docker

root@raspberry-app:/var/www/discourse# telnet 172.17.0.1 1026
Trying 172.17.0.1...
telnet: Unable to connect to remote host: Connection refused