Files

T

admin 4581a92781 app-email: smtp_mapping for vaultwarden + mealie

Vaultwarden via STARTTLS (accepts self-signed shim cert); Mealie via plaintext
(NONE) — no accept-invalid-cert option, spike-validated mode. Compose files
reference injected ${SMTP_*}. README documents the pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-29 08:45:23 +02:00

2.5 KiB

Raw Blame History

REPORT — App-email `smtp_mapping` for Vaultwarden + Mealie

Date: 2026-06-29 Task: SMTP app-relay (catalog leg). Add smtp_mapping to the two spike-proven apps so deployed apps can send outbound email via the managed path (app → in-controller shim → hub → Resend). Implements felhom.eu/documentation/audits/SPIKE-smtp-app-relay-2026-06-28.md §7.

Files modified

templates/vaultwarden/.felhom.yml — added smtp_mapping (STARTTLS; SMTP_SECURITY=starttls, SMTP_FROM=vaultwarden@felhom.eu, SMTP_FROM_NAME, + SMTP_ACCEPT_INVALID_CERTS/HOSTNAMES). SMTP_USERNAME/ SMTP_PASSWORD intentionally unset.
templates/vaultwarden/docker-compose.yml — reference the injected ${SMTP_*} keys (harmless defaults).
templates/mealie/.felhom.yml — added smtp_mapping (plaintext; SMTP_AUTH_STRATEGY=NONE on :2525, SMTP_FROM_EMAIL=mealie@felhom.eu, SMTP_FROM_NAME).
templates/mealie/docker-compose.yml — reference the injected ${SMTP_*} keys (harmless defaults).
README.md — documented the smtp_mapping pattern (field table + STARTTLS-vs-plaintext guidance) so further apps are easy adds.
CHANGELOG.md — entry.

How it works

When app-email is on (global toggle + per-app toggle), the controller injects at deploy/redeploy: SMTP_HOST = the on-box shim, SMTP_PORT = 2525, From = <app>@felhom.eu, the app's security value, plus the mapping's fixed extra vars. The values are derived from settings each compose — never persisted to app.yaml. An empty SMTP_HOST (toggle off) leaves the app's mail disabled.

Validation

Both .felhom.yml and both docker-compose.yml YAML-validated OK.
Field names match the controller's stacks.SMTPMapping struct tags exactly (covered by the controller's TestMetadata_SMTPMappingParse and the Vaultwarden/Mealie env-injection tests).
Git sync picks up the change within ~15 min (or via "Sablonok frissítése").

Notes / deviation

Mealie uses plaintext (NONE), not STARTTLS. Mealie has no accept-invalid-cert option, so STARTTLS to the self-signed shim would fail cert verification; the spike validated Mealie via plaintext on :2525 (the shim is Docker-network-only, never published). This is the spike-faithful choice (spike §7 mealie table = NONE), deviating from the prompt's Part-4 "TLS for mealie" wording.
Scope = these two proven apps only. Further apps (immich, nextcloud, …) are a follow-on: each just needs its own smtp_mapping block + the matching compose ${VAR} lines.

2.5 KiB Raw Blame History