From 99b4b3f78dbfccad1ae50b849d131d0bbd440122 Mon Sep 17 00:00:00 2001 From: emi Date: Thu, 23 Jul 2026 04:45:15 +0000 Subject: [PATCH] Mail docs: stack-mode gateway + postfix umbrella-unit gotcha (#12) --- deploy/provision-mail.sh | 12 ++++++++++++ deploy/thermograph.env.example | 4 ++++ 2 files changed, 16 insertions(+) diff --git a/deploy/provision-mail.sh b/deploy/provision-mail.sh index 0958d25..04f1ed6 100755 --- a/deploy/provision-mail.sh +++ b/deploy/provision-mail.sh @@ -67,6 +67,18 @@ postconf -e "myorigin = ${MAIL_DOMAIN}" # gateway and accepts mail from the bridge subnet (both pinned in # docker-compose.yml). Set DOCKER_MAIL_GATEWAY="" for a pure loopback-only null # client (app running natively on the host, not in a container). +# +# WHICH gateway depends on the host's deploy mode: plain compose (beta, LAN) +# uses the pinned compose bridge (172.19.0.1/172.19.0.0/16, the defaults); +# Swarm-stack mode (prod) uses the docker_gwbridge gateway instead -- +# overlay tasks have no compose-bridge gateway -- so prod is provisioned with +# DOCKER_MAIL_GATEWAY=172.18.0.1 DOCKER_MAIL_SUBNET=172.18.0.0/16 (plus its +# MESH_MAIL_* listener below). Do NOT list an address that doesn't exist on +# the host: Postfix's master fails to bind and takes ALL listeners down -- +# exactly what happened when the compose bridge (172.19.0.1) vanished at the +# stack cutover while still listed in inet_interfaces. Also note: postfix on +# this distro is an umbrella unit; restart `postfix@-`, not `postfix`, for +# inet_interfaces changes to take effect. DOCKER_MAIL_GATEWAY="${DOCKER_MAIL_GATEWAY-172.19.0.1}" DOCKER_MAIL_SUBNET="${DOCKER_MAIL_SUBNET-172.19.0.0/16}" # Optional WireGuard-mesh listener: other mesh nodes (e.g. beta's Forgejo, whose diff --git a/deploy/thermograph.env.example b/deploy/thermograph.env.example index 9b559f1..29a1f07 100644 --- a/deploy/thermograph.env.example +++ b/deploy/thermograph.env.example @@ -131,6 +131,10 @@ THERMOGRAPH_BASE_URL=https://thermograph.org # plain SMTP to the compose bridge's gateway (172.19.0.1, pinned in # docker-compose.yml), where Postfix listens and relays out. Switching between # "direct to MX" and "relay through a provider" is a Postfix change, no redeploy. +# Stack-mode hosts (prod) override this per-service to the docker_gwbridge +# gateway (172.18.0.1) in deploy/stack/thermograph-stack.yml -- overlay tasks +# can't reach a compose bridge gateway; leave this file's value as the compose +# default. # # Backends: console (log it, send nothing — the default, right for dev), # smtp (actually send), disabled (drop silently).