app-email: calcom + nextcloud mappings (tls_mode=plaintext, nextcloud split-From)

calcom (Nodemailer) + nextcloud (Symfony) opportunistically STARTTLS with no cert-skip
-> tls_mode=plaintext (:2526, no STARTTLS advertised). nextcloud splits From via
from_domain_var (MAIL_FROM_ADDRESS + MAIL_DOMAIN). Compose files reference injected env.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/calcom/.felhom.yml

@@ -81,3 +81,17 @@ healthcheck:
       path: "/api/health"
       expect:
         status: 200
+
+# --- App-email mapping (apps → in-controller shim → hub → Resend) ---
+# Cal.com (Nodemailer) hard-codes TLS rejectUnauthorized=true with no skip flag and opportunistically
+# STARTTLS-upgrades whenever the server offers it — so it cannot use the self-signed :2525 listener.
+# tls_mode=plaintext points it at the :2526 listener, which does NOT advertise STARTTLS, so Cal.com never
+# attempts TLS (plaintext on the single-tenant app bridge — accepted posture). secure is inferred from the
+# port (≠465 → plaintext). EMAIL_SERVER_USER/PASSWORD stay unset (the shim accepts no-auth).
+smtp_mapping:
+  tls_mode: plaintext
+  host_var: EMAIL_SERVER_HOST
+  port_var: EMAIL_SERVER_PORT
+  from_var: EMAIL_FROM
+  from_name_var: EMAIL_FROM_NAME
+  from_local: calcom