Gmail and other large providers refuse mail sent directly from our
residential IP. Send outbound mail through an SES SMTP relay configured
from the vault (mail_relay_host, mail_relay_user, mail_relay_password).
Unset values fall back to direct delivery.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The LDAP domain filter matched every entry with a mail attribute, so
membership accounts with external addresses (e.g. @gmail.com) made
those domains local and outbound mail to them bounced with 550 5.1.1.
Restrict the filter to the Postfix Users group, like the user filter.
Pin docker-mailserver to 15.1.0: v17 renamed the LDAP_QUERY_FILTER_*
variables and chowns /var/mail to 5000:5000 at startup, which breaks
this LDAP uid-per-mailbox setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop discourse-ldap-auth (its authenticator ignores ldap_enabled) and
add an idempotent settings script, run after deploy, that disables
LDAP login and installs a theme component sending Sign Up to
www.eom.dev/members.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The chart defaulted to the "nano" preset (192Mi memory limit), which
Prometheus outgrew, leaving it OOM-killed in a crash loop for ~25 days.
Request 250m/1Gi and limit 1 CPU/2Gi instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Grafana now has its own role (DevOps/ansible-role-grafana). Remove its
tasks and LDAP template from this role and drop it from full.yaml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This change was made to recover from an update made while attempting to address DevOps/ansible-role-eom#37, which was not solved here.
Reviewed-on: #38
claudeandClaude Opus 5.5
