app-email: calcom + nextcloud mappings (tls_mode=plaintext, nextcloud split-From)

calcom (Nodemailer) + nextcloud (Symfony) opportunistically STARTTLS with no cert-skip
-> tls_mode=plaintext (:2526, no STARTTLS advertised). nextcloud splits From via
from_domain_var (MAIL_FROM_ADDRESS + MAIL_DOMAIN). Compose files reference injected env.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/nextcloud/.felhom.yml

@@ -99,3 +99,18 @@ healthcheck:
       expect:
         status: 200
         body_contains: "installed"
+
+# --- App-email mapping (apps → in-controller shim → hub → Resend) ---
+# Nextcloud (Symfony Mailer) has no env to skip TLS cert verification and opportunistically STARTTLS-upgrades,
+# so it can't use the self-signed :2525 listener → tls_mode=plaintext points it at :2526 (STARTTLS NOT
+# advertised → no upgrade attempted; plaintext on the single-tenant app bridge — accepted posture).
+# Nextcloud SPLITS the From into local-part + domain, so from_var=MAIL_FROM_ADDRESS (local) +
+# from_domain_var=MAIL_DOMAIN → nextcloud@felhom.eu. No security_var (SMTP_SECURE stays empty = no TLS);
+# SMTP_NAME/PASSWORD unset (no auth). The official image reads these via getenv() on every boot.
+smtp_mapping:
+  tls_mode: plaintext
+  host_var: SMTP_HOST
+  port_var: SMTP_PORT
+  from_var: MAIL_FROM_ADDRESS
+  from_domain_var: MAIL_DOMAIN
+  from_local: nextcloud