docs: REPORT + CHANGELOG — gitea/rallly send-tested live; findings + template fixes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-29 11:06:57 +02:00
parent 32c730f749
commit 42bf76f540
2 changed files with 72 additions and 38 deletions
@@ -5,8 +5,13 @@
  `FORCE_TRUST_SERVER_CERT=true` to trust the shim's self-signed cert; single `GITEA__mailer__FROM`). Compose
  references the injected `GITEA__mailer__*` keys; env applied every boot.
 - **rallly** — added `smtp_mapping` (Nodemailer STARTTLS, `SMTP_SECURE=false` + `SMTP_REJECT_UNAUTHORIZED=false`
-  to accept the self-signed cert; single `NOREPLY_EMAIL`). **Also fixed a broken image pin:** `3.12.1` does not
-  exist (3.x stops at 3.11.x) → corrected to `3.11.2` so the template is deployable.
+  to accept the self-signed cert; single `NOREPLY_EMAIL`). **Also fixed three pre-existing template bugs** that
+  made rallly undeployable (never caught because the bad pin never ran): (1) image pin `3.12.1` doesn't exist →
+  `3.11.2`; (2) healthcheck used `wget`, absent from the rallly image (exit 127) → container unhealthy →
+  **Traefik wouldn't route it** → replaced with a Node http check; (3) added required `SUPPORT_EMAIL` + a valid
+  `NOREPLY_EMAIL` default (rallly refuses to boot without them).
+- **Both gitea and rallly send-tested live** end-to-end (app → shim → hub → Resend): gitea password-reset
+  (From `gitea@felhom.eu`) and rallly registration code (From `rallly@felhom.eu`) both delivered.
 - **NOT wired — reported as findings** (`felhom.eu/documentation/audits/FINDING-app-email-rollout-2026-06-29.md`):
  - **cal.com v4.8.7** — hard-codes TLS `rejectUnauthorized:true` with no override; opportunistic STARTTLS
    against the self-signed shim fails. Needs a non-STARTTLS-advertising plaintext listener (mechanism change).