admin
4581a92781
Vaultwarden via STARTTLS (accepts self-signed shim cert); Mealie via plaintext
(NONE) — no accept-invalid-cert option, spike-validated mode. Compose files
reference injected ${SMTP_*}. README documents the pattern.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
39 lines
2.5 KiB
Markdown
39 lines
2.5 KiB
Markdown
# REPORT — App-email `smtp_mapping` for Vaultwarden + Mealie
|
|
|
|
**Date:** 2026-06-29
|
|
**Task:** SMTP app-relay (catalog leg). Add `smtp_mapping` to the two spike-proven apps so deployed apps can
|
|
send outbound email via the managed path (app → in-controller shim → hub → Resend). Implements
|
|
`felhom.eu/documentation/audits/SPIKE-smtp-app-relay-2026-06-28.md` §7.
|
|
|
|
## Files modified
|
|
- `templates/vaultwarden/.felhom.yml` — added `smtp_mapping` (STARTTLS; SMTP_SECURITY=starttls,
|
|
SMTP_FROM=vaultwarden@felhom.eu, SMTP_FROM_NAME, + SMTP_ACCEPT_INVALID_CERTS/HOSTNAMES). SMTP_USERNAME/
|
|
SMTP_PASSWORD intentionally unset.
|
|
- `templates/vaultwarden/docker-compose.yml` — reference the injected `${SMTP_*}` keys (harmless defaults).
|
|
- `templates/mealie/.felhom.yml` — added `smtp_mapping` (plaintext; SMTP_AUTH_STRATEGY=NONE on :2525,
|
|
SMTP_FROM_EMAIL=mealie@felhom.eu, SMTP_FROM_NAME).
|
|
- `templates/mealie/docker-compose.yml` — reference the injected `${SMTP_*}` keys (harmless defaults).
|
|
- `README.md` — documented the `smtp_mapping` pattern (field table + STARTTLS-vs-plaintext guidance) so further
|
|
apps are easy adds.
|
|
- `CHANGELOG.md` — entry.
|
|
|
|
## How it works
|
|
When app-email is on (global toggle + per-app toggle), the controller injects at deploy/redeploy:
|
|
`SMTP_HOST` = the on-box shim, `SMTP_PORT` = 2525, From = `<app>@felhom.eu`, the app's security value, plus the
|
|
mapping's fixed `extra` vars. The values are derived from settings each compose — never persisted to `app.yaml`.
|
|
An empty `SMTP_HOST` (toggle off) leaves the app's mail disabled.
|
|
|
|
## Validation
|
|
- Both `.felhom.yml` and both `docker-compose.yml` YAML-validated OK.
|
|
- Field names match the controller's `stacks.SMTPMapping` struct tags exactly (covered by the controller's
|
|
`TestMetadata_SMTPMappingParse` and the Vaultwarden/Mealie env-injection tests).
|
|
- Git sync picks up the change within ~15 min (or via "Sablonok frissítése").
|
|
|
|
## Notes / deviation
|
|
- **Mealie uses plaintext (NONE), not STARTTLS.** Mealie has no accept-invalid-cert option, so STARTTLS to the
|
|
self-signed shim would fail cert verification; the spike validated Mealie via plaintext on :2525 (the shim is
|
|
Docker-network-only, never published). This is the spike-faithful choice (spike §7 mealie table = NONE),
|
|
deviating from the prompt's Part-4 "TLS for mealie" wording.
|
|
- **Scope = these two proven apps only.** Further apps (immich, nextcloud, …) are a follow-on: each just needs
|
|
its own `smtp_mapping` block + the matching compose `${VAR}` lines.
|