To set-up email for Gitea check out the the following email providers recommended by Discourse:
### Recommended Email Providers for Discourse
We strongly recommend using a dedicated email service. Email server setup and maintenance is _very_ difficult even for experienced system administrators, and getting any part of the complex required email setup wrong means your email won't be delivered, or worse, delivered erratically.
The following are template configurations for email service providers known to work with Discourse.
_The pricing information is included as a courtesy, and may be out of date. Discourse does not control the pricing for external services, be sure to check with the email provider for up to date pricing information._
**Please note that in any email provider, you _must_ verify and use the subdomain, e.g. `discourse.example.com`. If you verify the domain only, e.g. `example.com`, mail will not be configured correctly.**
Enter these values when prompted by `./discourse-setup` per the [install guide](https://github.com/discourse/discourse/blob/main/docs/INSTALL-cloud.md#edit-discourse-configuration). To change the current email service, run `./discourse-setup` as well (this will bring the forum offline for a few minutes while it gets rebuilt).
#### [Mailgun][gun] — 5k emails/month on a 3 month trial
SMTP server address? smtp.mailgun.org
SMTP user name? [SMTP credentials for your domain under domains tab]
SMTP password? [SMTP credentials for your domain under domains tab]
#### [SendGrid][sg] — 40k emails on a 30 day trial
show original
Assuming you chose Mailgun do the following:
Add your Gitea domain in Mailgun
Add the Mailgun-suggested DNS records to domain. Rather than waiting 24-48 hours for DNS propogation look for the button inside Mailgun to check manually from the Mailgun dashboard.
Edit your app.ini file to enable user registrations, email confirmations and set a noreply address. Look in the [services] section for this stuff and reference the Config Cheat Sheet for help.
In the [mailer] section set the following: ENABLED=true, FROM=noreply@git.example.org, USE_SENDMAIL=false, HOST=smtp.mailgun.org:587, USER=[from-mailgun-dashboard], PASSWD=[from-mailgun-dashboard].
Consider also setting ENABLE_NOTIFY_EMAIL while youâre in there, then save and exit app.ini and then (assuming Docker) run a docker container restart [container_id] (available from docker ps).
Test emails can then be sent from the admin configuration settings as suggested here:
You can also send a test email via the admin configuration settings page.
[47%20PM]
If all went well you should receive an email within a few seconds.
You can also send a test email via the admin configuration settings page.
1 Like
Email registration has been working well and Iâve had a number of users activate accounts. Since updating to to 1.5.2 Iâve seen a bunch of bots try and create accounts using various email addresses, some of which seem to be real given two users filed complaints (as reported by Mailgun):
Hereâs what the spam accounts look like. Iâll find a way to bulk remove them later but none of them have activated so Iâm not particularly concerned about them right nowâjust sharing for the benefit of others:
1 Like
@anon74399538 I know this is slightly off topic for this thread, but if you are concerned about being blocked from mailgun for sending email to these spammers you could use captcha (there is google recaptcha and just a plain built in system too that are options) to prevent these spammers.
1 Like
Good idea. A PoW-based tiny url might be useful too for accessibility and privacy compared to reCAPTCHAâwhich Iâve found to be sometimes unbearable gauntlet when using a socks5 proxy while browsing or traveling in SEA. Hereâs a mirror which seems like a fun way to get some practice in with WireShark while taking some focus of the actual honey.
https://git.habd.as/comfusion/esp8266_honeypot
Also found this super useful feature today:
Since none of the bots were able to activate their accounts I was able to purge about 160 of them with one click. As for where the bots came from who knows.
After three weeks of logging here are some observations about the email spam Iâve collected in case itâs useful for anyone. First, the last two days of logs (2 failures and 1 complaint) visualized:
Raw log data from Mailgun
Search logs
11/05/18 12:00 AM - 11/07/18 11:59 PM
Date/Time Summary @hotmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @verizon.net âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @charter.net âPlease activate your accountâ @gmail.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @hotmail.co.uk âPlease activate your accountâ @gmail.com âPlease activate your accountâ @mac.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @3bauto.co.uk âPlease activate your accountâ @cox.net âPlease activate your accountâ @gmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ larry.co *****@verizon.net âPlease activate your accountâ @gmail.com âPlease activate your accountâ @sbcglobal.net âPlease activate your accountâ @comcast.net âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @aol.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @wilsonmgmt.com âPlease activate your accountâ @hotmail.com âPlease activate your accountâ @gmx.de âPlease activate your accountâ @gmail.com âPlease activate your accountâ @aol.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @aol.com âPlease activate your accountâ @naver.com âPlease activate your accountâ @gmx.de âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @aol.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @livemaster.ru âPlease activate your accountâ @me.com âPlease activate your accountâ @aol.com âPlease activate your accountâ @brandongiesing.com â[after-dark] Web Mining (#7 )â @yahoo.com âPlease activate your accountâ @dotweekly.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @aol.com âPlease activate your accountâ @alumni.shu.edu âPlease activate your accountâ @mac.com âPlease activate your accountâ @verizon.net âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @comcast.net âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @hotmail.com âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @comcast.net âPlease activate your accountâ @hotmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @verizon.net âPlease activate your accountâ @yahoo.com âPlease activate your accountâ mpreal@comcast.net âPlease activate your accountâ @gmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ mpreal@comcast.net âPlease activate your accountâ @hotmail.com âPlease activate your accountâ @btinternet.com âPlease activate your accountâ @comcast.net âPlease activate your accountâ @yahoo.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @comcast.net âPlease activate your accountâ @gmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @gmail.com âPlease activate your accountâ @icloud.com âPlease activate your accountâ @yahoo.de âPlease activate your accountâ @brandongiesing.com â[after-dark] Web Mining (#7 )â @web.de âPlease activate your accountâ @gmail.com âPlease activate your accountâ
Parsing the logs the only thing that popped out at me was:
11/05/18 01:01 PM Complained: mpreal@comcast.net 'Please activate your account'
Which I found on a blacklist here with a mention of WordPress: https://cleantalk.org/blacklists/mpreal@comcast.net
So far all spam accounts use the âSatGuachâ postfix in their name.
Regarding the removal of unactivated accounts via the Admin Dashboard, Iâve observed as least some of the offending users were not removed as they were activated as shown here:
This seems to suggest the bots may now be following email activation links. And while I understand reCAPTCHA was added with the 1.6.0 release I have expressed some of my concerns on using it.
SatGuach fell out of favor, at least on https://git.habd.as and the new faux users are now using the âPlomsâ suffix, as shown here. As like the prior, running a Delete all unactivated accounts from admin Maintenance Operations will typically purge these users.
And while I respect the authors of Gitea for providing a CAPTCHA option, I still do not feel using reCAPTCHA is a good approach for those with well wishes for the privacy of their users .
cim
February 11, 2019, 12:37pm
11
Can someone help me with this? I have Gitea with MySQL in docker containers and the mailer times out when sending out test emails.
[mailer]
ENABLED = true
USE_SENDMAIL = false
HOST = smtp.mailgun.org:587
FROM = no-reply@domain.tld
USER = postmaster@git.domain.tld
PASSWD = 'password-has-special-chars'
# nginx error log
2019/02/11 04:36:33 [error] 19682#0: *11322 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 73.66.xxx.xxx, server: git.domain.tld, request: "POST /admin/config/test_mail HTTP/2.0", upstream: "http://127.0.0.1:3000/admin/config/test_mail", host: "git.domain.tld", referrer: "https://git.domain.tld/serviceworker.js"
@anon74399538 there is a non-reCAPTCHA CAPTCHA system provided by Gitea as well. (look at CAPTCHA_TYPE setting in docs )
1 Like
Just adding this in as a note for others coming from Google or otherwise, @cim âs problem was solved as their host had blocked the email port, and once unblocked everything was solved.
