On this page

Mail: approval by e-mail#

Hyvop can mail each person whose approval a remediation plan needs. They open a link, read the plan and approve or reject it, without an account. This page is for the person who installs Hyvop and has to give it a mail relay.

No relay is the default#

A new install has no mail relay. Nothing is sent, the product says so, and each approver is reported as not mailed: invitations and links are handed over on screen instead. That is a supported way to run. Everything below is for turning mail on.

Who is mailed depends on the edition#

core.approvals.requests is by-edition by default (approvals.md). In the Enterprise Edition the approvers are mailed once a relay is named, as described below. In the Community Edition remediation stops at a preview: nothing is mailed, reminded or escalated whatever relay is set, and the plan shows each step as "would ask". Answers on the screen still count. Set core.approvals.requests: send to mail in every edition.

Name a relay#

In your values file:

yaml

core:
  env:
    FRONTEND_URL: https://hyvop.example.org   # the public address; without it no link can be made
  mail:
    host: smtp.example.org
    port: 587
    username: hyvop@example.org
    password: ""                              # see "The password" below
    from: hyvop@example.org
networkPolicy:
  egress:
    mailCidrs: ["203.0.113.25/32"]

Value	Meaning
`core.mail.host`	The relay. Empty: no relay. Nothing below is passed to core until it is set.
`core.mail.port`	587 (STARTTLS) as shipped; 465 or 25 if your relay uses them.
`core.mail.username`	The account at the relay.
`core.mail.from`	The sender address. Most relays refuse an address they do not host: set it.
`core.mail.smtpAuth`, `core.mail.starttls`	Both are true in core unless you set `false` here.

An administrator can also set or remove the relay in the settings screen, send a test message from it, and read where mail leaves from. A relay saved there is encrypted under the data key.

The password#

The password is not written into the pod. The chart keeps core.mail.password in the Secret hyvop-core-secrets under the key mail-password, and core reads it from there. With core.existingSecret (External Secrets, Vault), leave core.mail.password empty and put mail-password in your Secret.

Letting core reach the relay#

Core's network policy allows the internet on port 443 only, and a relay listens on 587 or 25. A network policy cannot follow a host name, so give the relay's addresses in networkPolicy.egress.mailCidrs. Core may then reach those addresses on the relay's port and on no other. With a relay named and no list set, the install notes say that mail will not leave.

Approval by e-mail#

Value	Default in core	Meaning
`core.mail.approvals.onPlan`	`true`	Mail the required approvers when a plan is made. `false`: only when an operator asks.
`core.mail.approvals.linkValidity`	`7d`	How long a mailed link works.
`core.mail.approvals.reminderInterval`	`3d`	How often an approver who has not answered is reminded; `0` sends none.
`core.mail.approvals.maxReminders`	`2`	How many reminders at most.

What to tell approvers: the link is theirs alone and proves the mailbox it was sent to. Opening it decides nothing (the page shows the plan and the answer is a separate step, so a mail scanner that follows links answers nothing). A forwarded e-mail lets its holder answer in the approver's name until the link expires. The answer is recorded the same way as a signed-in answer, with the channel EMAIL, the mailbox and the address it came from.

Checking it#

In the settings screen the mail status shows the host and where it comes from; send a test message to yourself. The answer is the mail server's own words.
If nothing arrives, see "No approval e-mail arrives" in troubleshooting.md.