Users: Exploring email sending

[javorszky]

Users: Exploring email sending

[ricardobeat]

that slice of the chat is missing, do you mind pasting it here?

I think sending a small amount of messages is ok with the users' gmail/smtp account. Ghost should encourage using application-specific passwords for that, and/or migrating to an email provider like postmark/sendgrid/etc for higher volume.

Alternatively ghost.com could serve as a notification/relay service. Messages from a local install would be redirected to an API that forwards them to registered users. That would require zero configuration after install; the user could then replace that with SMTP at their will.

[javorszky]

Started as on offtopic to something else, but the logs:

[23/05/2013 09:23:58] Hannah Wolfe: Having comprehensive users, groups and permissions functionality is one of the key differentiators from WP - we'll only be exposing a small part of it to start with, but we intend to support complex user types and workflows eventually
[23/05/2013 09:25:10] Gabor Javorszky: hm, I'll think about that. It's not the easiest of topics to do well
[23/05/2013 09:27:02] Gabor Javorszky: I would also start by designing the permissions bits before choosing a library to handle that
[23/05/2013 09:27:57] Hannah Wolfe: Being able to send emails is another sizable piece which is worth thinking about separately I think.  And then that leads on to the ability to schedule stuff (emails, posts, etc)

If Ghost is self hosted the user will also have to create an application on Google that would allow oauth authentication from that specific install address. ghost.com installations could use a central google app though.

The not/relay would allow communication between users of ghost then? I'm thinking more about situations where I need to have my password reset, and Ghost will send me an email with the new password in it.

[ricardobeat]

@javorszky password recovery was what first crossed my mind. Making it go through a centralized server might spook some people, but it would be easy to opt-out.

I thought of that api relay as a 'private' email service. It only forwards mail to registered users's addresses, otherwise it's just like sendgrid/etc. It would basically exist for password-recovery when the user hasn't configured SMTP, didn't think of anything fancy/social.

[JohnONolan]

Email notifications are a must for several things - however both from a philosophical standpoint as well as a technical one, I would be uncomfortable relying on 3rd party (eg. Google) for this.

WordPress do this - worth looking at as a starting / reference point ?

[ricardobeat]

We wouldn't be depending on Google directly for this, the user can choose the e-mail provider he uses. That's where ghost.org's servers could come in as a stopgap.

PHP hosts usually have their environment setup so the mail() function just works, but that is very unlikely for most node.js hosts and PaaS. In addition to that WP can use SMTP via plugins.

[javorszky]

The reason I asked is because of any of these:

https://github.com/dresende/node-smtp (needs an smtp server)
https://npmjs.org/package/nodemailer 👍 (seems the best of all)
https://npmjs.org/package/express-mailer (needs an smtp server)
https://github.com/substack/node-pony
https://npmjs.org/package/simplesmtp
https://npmjs.org/package/active-sender
https://npmjs.org/package/Haraka (or if we want to be super-hairy)

I don't know whether node has any native SMTP functionality, but @ricardobeat makes me feel it doesn't. So how do we solve the "there aren't any smtp servers around" problem? Run one on localhost, or be confident that whoever takes up node hosting also has access to an smtp server?

[javorszky]

With regards to SMTP functionality:

• http://sendgrid.com/ is an option, free tier has 200 emails a day. This is what telescope notifications run off of
• https://mailgun.com/ is another option, same free tier, haven't used it

Other than this, hosted people could use the server that they're on. Self hosted people can use their own smtp that comes with their hosting, or configure google to do their bidding.

[JohnONolan]

@javorszky Let's try and detect + use sendmail on the local environment, for the time being, as a base default.

[javorszky]

Aite, I'll crack on this later today.

[javorszky]

Relevant (ish) http://www.campaignmonitor.com/resources/will-it-work/email-clients/

[JohnONolan]

@javorszky where are we on this?

[javorszky]

Today - tomorrow to detect sendmail. What should be used as fallback? Config so they can put in their own smtp details?

[JohnONolan]

Fallback will have to be a 0.3 task, just want to get something in place for 0.2 atm

[javorszky]

Keeping this here for future reference: http://pauldowman.com/2008/02/17/smtp-mail-from-ec2-web-server-setup/

[ErisDS]

This issue was intended as exploratory to start with. To make sure that it has a clear endpoint:

• Ghost should be able to detect sendmail
• It should be possible to supply SMTP via config.js
• If SMTP are provided these should be used instead of sendmail - i.e. sendmail is the fallback, a user's custom provided settings should always take priority
• If neither are provided there should be a persistent notification informing the user of the need to install SMTP details - although this is kinda tricky because notifications are on a branch, so if this gets done before notifications gets merged this last item should be moved into a separate issue.

[ricardobeat]

Anyone working on this? Thoughts on https://github.com/andris9/nodemailer?

[javorszky]

Nodemailer has been referenced previously (see #53 (comment)) . Theoretically I'm working on it, but dayjob took over my life, and I'm putting out fires. If you want it, go for it.

As it stands:

• find sendmail on the server if it's installed (and not sure whether there's a standard place to install them, but nodemailer seems to think there is)
• if not, display notification that they don't have emial.
• maybe provide fallback with their own smtp details should they choose to use sendgrid, mailjet, mailgun or something similar.

[ErisDS]

I have assigned this to @ricardobeat for now. #53 (comment) this comment summarises expectations from the issue, there is a follow up issue #287 which takes this further

[ErisDS]

@ricardobeat can you let me know if you are 1) working on this 2) not working on this but will do or 3) not working on this and don't plan to? It's now marked as Top Priority as a few things depend on this.

[cgiffard]

I'm happy to help out with this, if required.

[ricardobeat]

Working on it, will send a PR today.

@cgiffard would you like to work on the notification thing? I think we can do that in parallel.

[cgiffard]

@ricardobeat I might wait until I've worked through my current queue of stuff, but once I have, I'm happy to run with that.

[ricardobeat]

So, there is no reliable way to detect that sendmail is working or not. It might return a successful exit code, and never really deliver the e-mail. Trying to infer success from log files or other means will throw us into a cross-platform blackhole.

So, I think the following init sequence makes sense:

1. if the user provided SMTP details in config.js, run normally
2. if SMTP isn't set up, and the platform is *nix, attempt to locate the sendmail binary
   • if sendmail is found, use it, and display a warning that sendmail is in use, and must be configured correctly
   • this notification can be disabled by setting sendmail: true in config.js, in case the user is certain it's working
3. otherwise, display warning saying e-mail must be configured using an SMTP provider or amazon SES, link to documentation

Maybe a welcome e-mail could be sent some point after an install, so the user knows it's functioning.

thoughts?

ps: this kind of discourages the use of sendmail, which is good for several reasons

[gotdibbs]

@ricardobeat I completely agree with your logical flow from what I've read and what I've seen before of how different platforms handle this. I also like the idea of a post-install welcome e-mail, but might also suggest some sort of on-demand "test e-mail configuration" feature.

[JohnONolan]

That all sounds pretty painful.

ps: this kind of discourages the use of sendmail, which is good for several reasons

I don't understand this unless you have an alternative to suggest?

[ErisDS]

I think what @ricardobeat is getting at is that out in the wild, configuring sendmail for yourself is a bad idea.

If you are using a hosting provider that provides a fully installed, correctly functioning, properly tested and managed sendmail configuration (like our hosted service probably will) then everything is fine. If you are trying to setup Ghost on ec2 or some other VPS where you would have to install and configure sendmail for yourself, you probably want to avoid that and use something like sendgrid instead.

But this is my interpretation of what is being said :)

[ricardobeat]

Unfortunately that's the state pf things. Unless the admin is sure sendmail really works on their hosting provider, it is a terrible choice - there is no guarantee email will be sent or received (very high chance of triggering spam filters).

Setting up SMTP is just a matter of providing a few credentials, we could have a settings pane for it, with presets for the most used mail services.
—
Sent from Mailbox for iPhone

On Fri, Aug 9, 2013 at 3:58 AM, JohnONolan [email protected]
wrote:

That all sounds pretty painful.

ps: this kind of discourages the use of sendmail, which is good for several reasons

I don't understand this unless you have an alternative to suggest?

Reply to this email directly or view it on GitHub:
#53 (comment)

[ErisDS]

Hi @ricardobeat I'm getting a little bit nervous about this issue. Could you possibly push any code you have so far to your fork? If you're too busy please do let me know. We desperately need to be able to send forgotten password emails for 0.3.0

[ricardobeat]

(ignore github noise above, commits in the PR)