Improve SMTP config

[raulrpearson]

Overview

Drops Mua in favour of the SMTP Swoosh adapter and adjusts the config accordingly. The lock file has also been cleaned up by running mix deps.unlock --unused. Hopefully fixes #112. The new setup relies on :public_key.cacerts_get(), which assumes certificates are installed in the machine running the application.

I've tested against three SMTP setups:

• Resend using implicit SSL/TLS on port 465 (as far as I can tell).
• Postmark SMTP (not REST API) using StartTLS on port 587 (as far as I can tell).
• Locally with no SSL/TLS against Mailpit.

In all cases I have:

MAIL_TRANSPORT=smtp
MAIL_FROM=noreply@myverifieddomain.com
MAIL_FROM_NAME=Claper

Aside from obviously setting transport to SMTP, I'm not sure these matter for the purpose of this PR. I did set up the from variable to a domain I own and verified with Resend and Postmark to rule out emails not being delivered because of that. In the following snippets I've commented out the environment variables whose default value is already suitable.

Resend

Resend works with the following variables:

SMTP_RELAY=smtp.resend.com
SMTP_PORT=465
# SMTP_RETRIES=1
# SMTP_NO_MX_LOOKUPS=false

# SMTP_AUTH=always
SMTP_USERNAME=xxx
SMTP_PASSWORD=xxx

# SMTP_SSL=true
# SMTP_TLS=if_available
# SMTP_SSL_DEPTH=2
SMTP_SSL_SERVER=*.resend.com

It might also work with the 587 port and maybe setting SSL to false and TLS to always, to force StartTLS. The key addition vs before is using SMTP_SSL_SERVER to tell the underlying SSL/TLS implementation to accept a certificate that isn't for the exact relay host. This maybe was being done by Mua under-the-hood while it seems we need to set this explicitly when using the SMTP adapter which relies on gen_smtp.

Postmark

Postmark seems to work with the following variables:

SMTP_RELAY=smtp.postmarkapp.com
SMTP_PORT=587
# SMTP_RETRIES=1
# SMTP_NO_MX_LOOKUPS=false

# SMTP_AUTH=always
SMTP_USERNAME=xxx
SMTP_PASSWORD=xxx

SMTP_SSL=false
SMTP_TLS=always
# SMTP_SSL_DEPTH=2
SMTP_SSL_SERVER=postmarkapp.com

I was not able to get Postmark to deliver my emails, but calling the Swoosh delivery function in IEx returned and "ok queued <id>" tuple. I think I might need to add a credit card to Postmark, which I don't want to do, so I'm counting this as working.

Mailpit

I got Mailpit to work locally with an unsecured connection with the following variables:

SMTP_RELAY=localhost
SMTP_PORT=1025
# SMTP_RETRIES=1
SMTP_NO_MX_LOOKUPS=true

SMTP_AUTH=never
# SMTP_USERNAME=xxx
# SMTP_PASSWORD=xxx

SMTP_SSL=false
SMTP_TLS=never
# SMTP_SSL_DEPTH=2
# SMTP_SSL_SERVER=*.example.com

The key addition here is telling the underlying networking libraries not to try to resolve the relay host name with MX records, if I'm understanding this correctly.

[raulrpearson]

@alxlion, one concern I want to flag is that the removal of "unused" dependencies might mess something up. Specifically, I realised recently that ExAws defaults to hackney as an HTTP client for its API requests. This PR currently removes hackney from our dependencies.

We currently have Finch and Req. I'm not sure whether ExAws will pick up Req automatically or not. Can you look into this before promoting to production? Let me know if you want me to look deeper into this myself. I don't have an AWS account but could create one.

If we run into problems, maybe a solution would be adding http_client: ExAws.Request.Req to our :ex_aws config, as ExAws ships with such module.

[nmbgeek]

Hi @raulrpearson - I have been unable to get SMTP to work with Amazon SES SMTP or an MS Exchange Connector Relay w/ trusted IP (no smtp auth). My research and testing found that the middlebox compatability being enabled was causing my issues.

This branch resolves all of my issues: https://github.com/nmbgeek/Claper/tree/fix-smtp It disabled middlebox compatibility by default and enables it with a env variable. I guess there is no point in creating a PR if you will be changing the dependencies, but I just wanted to share this find. Also if you are reversing course and keeping the mua dependency then we would probably want to make the default of compatibility mode enabled so not to break anyone who is currently relying on it.

[raulrpearson]

Thanks for sharing these details, @nmbgeek. Ideally we can get your setup working with the changes put forward in this PR. I think @alxlion will have a chance to test this PR against Amazon SES SMTP, which will provide another data point.

Can you share your (redacted) SMTP env vars?

Have you tried disabling middlebox compatibility on this branch? My guess is that we could add that option under tls_options if necessary and that in that case you might need to have SMTP_SSL=false and SMTP_TLS=always.

[alxlion]

AWS S3 is working correctly 👍