Local mails use Supabase's default templates instead of ours (on SELinux hosts)

Open
#2,783 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
docker, go, linux
Domain
authentication, devops

Research direction

Search the CLI or container configuration for the bind mount of supabase/templates/*.mustache; no specific configuration file is named in the report. Reproduce on an enforcing SELinux host with Mailpit and inspect the auth and Kong logs. Done means the custom templates render and links use the app's /auth-return route.

Written by the indexing model from the issue text.

Description

bug

Symptoms (any of):

  • A magic link or password reset mail in Mailpit (http://localhost:54324) looks nothing like
    supabase/templates/*.mustache: no DropNext styling, and the link points at
    http://127.0.0.1:54321/auth/v1/verify?token=… instead of the app's /auth-return.
  • The auth container's log repeats
    templatemailer_template_body_http_error ... /email/magic_link.mustache: status code 403
    (docker logs $(docker ps -q --filter ancestor=public.ecr.aws/supabase/gotrue:v2.195.0), adjust the tag).

Root cause: the CLI bind-mounts the template files into the Kong container and GoTrue fetches
them from Kong on every send. The mount carries no :z relabel, so on a host with SELinux
enforcing (the repo's files are labelled mnt_t when the checkout lives on its own mount) Kong
gets "Permission denied" on files that are world-readable, answers 403, and GoTrue silently
falls back to its built-in templates. Nothing fails loudly, the mail is just a different mail.

Workaroud: relabel the template files so containers may read them (reversible with restorecon):

chcon -t container_file_t supabase/templates/*.mustache

Bug report

This should not be so hard. I think the mounts should carry a :z label so this gets easier.

Dominant language
Go
Stars
2.6k
Forks
764
Avg merge
5d 3h
Merged PRs (30d)
39

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/auth

All issues in supabase/auth

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.