app-email: calcom + nextcloud mappings (tls_mode=plaintext, nextcloud split-From)

calcom (Nodemailer) + nextcloud (Symfony) opportunistically STARTTLS with no cert-skip
-> tls_mode=plaintext (:2526, no STARTTLS advertised). nextcloud splits From via
from_domain_var (MAIL_FROM_ADDRESS + MAIL_DOMAIN). Compose files reference injected env.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/nextcloud/docker-compose.yml

@@ -33,6 +33,15 @@ services:
       - OVERWRITEPROTOCOL=https
       - OVERWRITEHOST=${SUBDOMAIN}.${DOMAIN}
       - REDIS_HOST=nextcloud-redis
+      # App-email (managed relay). Injected by the controller only when app-email is on (global + per-app);
+      # empty SMTP_HOST keeps Nextcloud mail disabled. Nextcloud uses the plaintext :2526 listener
+      # (tls_mode=plaintext, SMTP_SECURE empty = no TLS) — it can't skip the self-signed STARTTLS cert.
+      # From is split: MAIL_FROM_ADDRESS=nextcloud + MAIL_DOMAIN=felhom.eu. See .felhom.yml smtp_mapping.
+      - SMTP_HOST=${SMTP_HOST:-}
+      - SMTP_PORT=${SMTP_PORT:-25}
+      - SMTP_SECURE=${SMTP_SECURE:-}
+      - MAIL_FROM_ADDRESS=${MAIL_FROM_ADDRESS:-}
+      - MAIL_DOMAIN=${MAIL_DOMAIN:-}
     volumes:
       - nextcloud_html:/var/www/html
       - ${HDD_PATH}/appdata/nextcloud:/var/www/html/data