Using `s-nail` instead of `heirloom-mailx` to send emails

[ttionya]

The tool for sending emails, heirloom-mailx, has been removed in Alpine v3.18.

Please refer to the issue (https://gitlab.alpinelinux.org/alpine/aports/-/issues/14791) and commit (https://gitlab.alpinelinux.org/alpine/aports/-/commit/8f375abf662d2f84ff9b132e8710d6e25eeaf80f) in the Alpine/aports repository for more details.

Although it is possible to lock the Alpine version at 3.17, it is not an ideal solution. I prefer to continue using rclone as the base image, so we need to replace the email sending tool.

I plan to replace heirloom-mailx with s-nail because heirloom-mailx is a stub for s-nail. s-nail maintains a high degree of compatibility, although there may be some incompatible parts, the main options are compatible.

This change will take effect in the next version, and I am currently testing it.

The changes have taken effect in v1.19.0. Here is the s-nail documentation.

[ttionya]

To avoid introducing disruptive changes to the backup tool, I will lock the s-nail version to v14.9.x. If in the future Alpine cannot provide an APK package for v14.9, we will compile and install s-nail ourselves.

[ttionya]

Starting from v14.10 and future v15 versions, s-nail will adopt a new MTA (Mail-Transfer-Agent) credential, and users will be alerted to switch to the new credential promptly. As we will maintain s-nail v14.9, users can DISREGARD warning messages similar to the following.

mail: Warning: variable superseded or obsoleted: smtp
mail: Warning: variable superseded or obsoleted: smtp-auth-user
mail: Warning: variable superseded or obsoleted: smtp-auth-password
mail: Obsoletion warning: please do not use *smtp*, instead assign a smtp:// URL to *mta*!
mail: Obsoletion warning: Use of old-style credentials, which will vanish in v15!
mail:   Please read the manual section "On URL syntax and credential lookup"

Of course, you can switch to using MTA credentials on your own to eliminate the warning messages. Here's a simple conversion example:

# For Zoho
-S smtp-use-starttls \
-S smtp=smtp://smtp.zoho.com:587 \
-S smtp-auth=login \
-S smtp-auth-user=abc@example.com \
-S smtp-auth-password=mypassword \
-S from=abc@example.com

# Convert to MTA
-S v15-compat
-S smtp-use-starttls
# @ => %40
-S mta=smtp://abc%40example.com:mypassword@smtp.zoho.com:587
-S smtp-auth=login
-S from=abc@example.com

[kevdogg]

Hey I just wanted to chime in here a give another example for those that might want to avoid errors in the logs. I'm using arch linux as the client. SSL CA certs are located in /etc/ssl/certs (which I think is pretty standard for most linux distributions (although tls-ca-file could be used as an alternative to tls-ca-dir). The configuration below only used TLS 1.3 which nowadays seems to be the default with most mailers. TLS 1.2 could also be configured if needbe. I used this reference to configure s-nail for version 15: https://manpages.ubuntu.com/manpages/focal/en/man1/s-nail.1.html

-S v15-compat
-S mta=smtps://<user>:<password>@smtp.<domain>.com:465
-r bitwarden@<domain>.com(Bitwarden-Backup@archbw)
-S smtp-auth=login
-S tls-ca-dir=/etc/ssl/certs
-S tls-verify=strict
-S tls-config-pairs=Protocol=-ALL\,+TLSv1.3

[kevdogg]

Hey I've kind of revisited this issue recently, and here is my working config (which is variation of previous post):

-S v15-compat \
-S mta=smtps://<user>:<password>@smtp.<domain>.com:465 \
-S smtp-auth=login \
-S tls-ca-dir=/etc/ssl/certs \
-S tls-verify=strict \
-S tls-config-pairs='Protocol=TLSv1.3,Ciphersuites=TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256' \
-r "<username> <<username>@<hostname>>"

For the mta line, it possible to specify a specific port number if needbe. Usually for smtps I'm either using port 465 or 587

If you do not want verification of the TLS certs you can omit the tls-ca-dir and tls-verify lines.
This example is only using TLSv1.3. I've specified specific Ciphersuites here for completeness, however if you just want the default set of Ciphersuites which is probably good for 99% of cases, you could also write is as:

-S tls-config-pairs='Protocol=TLSv1.3'

There are multiple ways to configure the return address, but I'm just showing this as an example. The return address likely to get mangled by the MTA anyway.

[Lenart12]

Here is how I manage my smtp connection. I use user= instead of passing everything in the mta variable, since that does not need to be url encoded and is easier to maintain.

  backup:
    image: ttionya/vaultwarden-backup:latest
    restart: unless-stopped
    environment:
      # [ Snip ]
      MAIL_SMTP_ENABLE: 'TRUE'
      MAIL_SMTP_VARIABLES: >-
        -S 'v15-compat'
        -S 'mta=smtp://mail.example.com:587'
        -S 'smtp-use-starttls'
        -S 'smtp-auth=login'
        -S 'user=vaultwarden-noreply@example.com'
        -S 'password=myCr@z!Pa$sword123'
        -S 'from=Vaultwarden Backup <vaultwarden-noreply@example.com>'
      MAIL_TO: 'webmaster@example.com'

[hanisntsolo]

I have a feature requirement all backups are opening a new email thread when sent.

I want they to get looped in single thread for a cleaner email box.

[hanisntsolo]

Added the enhancement in this PR @ttionya pls review #211