On 23.10.24 00:09, Mark Sapiro wrote:

How are you creating the template? If you are creating it via Postorius,

Yes, via Postorius created using the url

https://lists.example.org/mailman3/lists/community.lists.example.com/templat...

what is your setting for POSTORIUS_TEMPLATE_BASE_URL and what does the

I did not set POSTORIUS_TEMPLATE_BASE_URL in settings.py.

entry in the template table in the database look like?

in mailman.template:

mailman=# select * from template where id = 6; 6|list:user:action:subscribe|community.lists.example.com|http://localhost:8000/mailman3/api/templates/list/community.lists.example.com/list:user:action:subscribe||

in mailmanweb.template:

mailmanweb=# select * from postorius_emailtemplate where id = 6; 6|list:user:action:subscribe|test1234||2024-09-09 13:52:22.377792+02|2024-10-14 15:11:43.029873+02|list|community.lists.example.com

POSTORIUS_TEMPLATE_BASE_URL should be the same URL you use to access Postorius up to but not including the /postorius/ or /mailman3/ part. I.e, for this list whose info page is at https:// lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/, the setting is

POSTORIUS_TEMPLATE_BASE_URL = 'https://lists.mailman3.org'

For testing I have set

POSTORIUS_TEMPLATE_BASE_URL = 'https://lists.example.org'

to the URL of our main domain, however, if I test an anonymous subscribe through the list info page I still get the timeout error

HTTPConnectionPool(host='localhost', port=8000): Read timed out. (read 
timeout=5)

Logs still show the same behaviour: the request for the template comes into the server but is finished and logged after 5 seconds:

127.0.0.1 - - [23/Oct/2024:05:51:38 +0000] "GET /mailman3/api/templates/list/community.lists.example.com/list:user:action:subscribe HTTP/1.1" 200 8 "-" "python-requests/2.32.3"

The tcpdump of the tcp conection also looks the same: the response is pushed with the termination of the connection.

I can access http://localhost:8000/mailman3/api/templates/list/community.lists.example.co... with curl and immediately get the response.

So it still looks to me as if the response is stuck in the tcp buffers of the connection and not pushed immediately, but only once the requestor times out after 5 seconds and closes the connection.

Thanks,

Gerald

On 23.10.24 21:35, Mark Sapiro wrote:

On 10/22/24 23:07, Gerald Vogt wrote:

...

For testing I have set

POSTORIUS_TEMPLATE_BASE_URL = 'https://lists.example.org'

to the URL of our main domain, however, if I test an anonymous subscribe through the list info page I still get the timeout error

This will have no effect unless you delete and recreate the template in Postorius because simple changing the setting won't change the uri in the template table.

O.K. Did that. Now the uri in mailman.template is https://lists.example.org/mailman3/api/templates/list/community.lists.exampl...

However, it doesn't change the timeout issue, except now the error is

HTTPSConnectionPool(host='lists.example.org', port=443): Read timed out. (read timeout=5)

instead of localhost:8000.

...

I can access http://localhost:8000/mailman3/api/templates/list/ community.lists.example.com/list:user:action:subscribe with curl and immediately get the response.

Can you do that as the Mailman user?, e.g.

sudo -u mailman curl http://localhost:8000/mailman3/api/templates/list/ 
community.lists.example.com/list:user:action:subscribe

assuming the Mailman user is mailman.

I don't quite understand the relevance of the user accessing the localhost tcp port. Any local user can do that.

I can access the template content with

curl http://localhost:8000/mailman3/api/templates/list/community.lists.example.co...

as well as

curl http://lists.example.org/mailman3/api/templates/list/community.lists.example...

as any user on the mailman server.

And I can use the latter to access the template from anywhere as it's a public server.

In any case, curl immediately returns the content. There is no delay.

Thanks,

Gerald

Mark Sapiro wrote:

On 10/23/24 13:23, Gerald Vogt wrote:

...

I don't quite understand the relevance of the user accessing the localhost tcp port. Any local user can do that. I am trying to duplicate what Mailman does in an attempt to find the issue. I can access the template content with curl http://localhost:8000/mailman3/api/templates/list/community.lists.example.co... as well as curl http://lists.example.org/mailman3/api/templates/list/community.lists.example... as any user on the mailman server. How about curl -A 'python-requests/2.32.3' http://lists.example.org/mailman3/api/templates/list/community.lists.example...

as the Mailman user?

I have tried anything I could think of but I cannot reproduce the issue using curl as user mailman (or any other for that matter)

Going directly for localhost:8000, using some or all of the headers I can capture with tcpdump:

$ curl -v -H 'Accept-Encoding: gzip, deflate' -H 'Connection: Keep-Alive' -H 'Host: lists.example.org' -A 'python-requests/2.32.3' http://localhost:8000/mailman3/api/templates/list/community.lists.example.com/list:user:action:subscribe

as well as going through the local httpd:

$ curl -v --http1.1 -H 'Accept-Encoding: gzip, deflate' -H 'Connection: Keep-Alive' -H 'Host: lists.example.org' -A 'python-requests/2.32.3' https://lists.example.org/mailman3/api/templates/list/community.lists.example.com/list:user:action:subscribe

Running tcpdump during those runs shows me it's sending the same headers as mailman does. Thus on http protocol level it's the same, but still the server returns immediately.

What I have just noticed is that the Date header in the delayed response is the "late" time. I have even compared tcp headers from either capture. They look identical down to the frame sizes.

The only difference the last times is that with curl, the server side sends the ACK for the request and milliseconds later a PSH,ACK with the response headers. When it comes internally from mailman it sends the ACK for the request and then 5 seconds later it sends the PSH,ACK with the response headers.

Thanks,

Gerald

On 24.10.24 22:09, Mark Sapiro wrote:

On 10/23/24 23:36, vogt@spamcop.net wrote:

...

The only difference the last times is that with curl, the server side sends the ACK for the request and milliseconds later a PSH,ACK with the response headers. When it comes internally from mailman it sends the ACK for the request and then 5 seconds later it sends the PSH,ACK with the response headers.

I'm unable to explain what's going on. You could try one more thing in an attempt to duplicate this outside of Mailman. Invoke the same python3 that Mailman does - this may be in a venv or the system python3. If in a venv, you don't need to activate the venv, just run venv/bin/python.

Then in response to Python's prompts do

 >>> import requests
 >>> res = requests.get('https://lists.example.org/mailman3/api/ 
templates/list/community.lists.example.com/list:user:action:subscribe', 
timeout=5)

and see what that does? I think it should time out because this is exactly what Mailman core is doing tho get the template, and if it does, perhaps you can determine why from this simple example.

I have tried it using the fqdn url as well as the localhost:8000 url but in both cases requests.get immediately returns the response. The server side pushes the response within milliseconds.

But that made me looking another time at the localhost tcpdump: I have noticed two connections to localhost:8000 where gunicorn with mailman_web.wsgi:application is running.

The first one is

POST /mailman3/lists/community.lists.example.com/anonymous_subscribe

the second one is

GET /mailman3/api/templates/list/community.lists.example.com/list:user:action:subscribe

Both take 5 seconds. First the first one responds then shortly after the second one. I have noticed that only two gunicorn processes are running which looked like only one is a worker.

Thus I have added workers=9 (2xncore+1) to /etc/mailman3/gunicorn.conf and restarted mailmanweb.service. Now it's working. So it must have been some kind of deadlock situation because it only had a single worker running.

I have just followed the docs from

https://docs.mailman3.org/en/latest/install/virtualenv.html#setting-up-gunic...

which doesn't mention anything about workers and I seriously don't have a clue about gunicorn. Maybe that could be added to the docs?

Thanks for the help!

Cheers,

Gerald