From ad353190f3fc5e3bbde3b0321cf3cebac94c1466 Mon Sep 17 00:00:00 2001
From: maro <mail@mgoth.de>
Date: Fri, 18 Sep 2026 11:59:33 +0200
Subject: [PATCH] Fix SMTP proxy certificates and speed up CI

---
 .env.example             |  3 +++
 .github/workflows/ci.yml | 19 +++++++++++--------
 DEPLOYMENT.md            |  2 +-
 lib/email/transport.ts   |  6 ++++++
 setup.sh                 |  1 +
 5 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/.env.example b/.env.example
index a94ca50..3201243 100644
--- a/.env.example
+++ b/.env.example
@@ -58,6 +58,9 @@ SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM="ANOUMA <support@anouma.org>"
+# Keep true for publicly trusted SMTP certificates. Set false only when the
+# configured SMTP proxy intentionally uses a private/self-signed certificate.
+SMTP_TLS_REJECT_UNAUTHORIZED=true
 
 # Address used as Reply-To for CMS replies. Configure this mailbox with an
 # inbound provider/webhook that POSTs replies to /api/email/inbound.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a8f16f8..27cae24 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,16 +35,13 @@ jobs:
         run: npx next typegen && npx tsc --noEmit
       - name: Test
         run: npm test
-      - name: Build
-        env:
-          NODE_ENV: production
-        run: npm run build
 
   build-image:
     needs: test
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     runs-on: ubuntu-latest
     permissions:
+      actions: write
       contents: read
       packages: write
     env:
@@ -58,7 +55,13 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build image
-        run: docker build -t "$IMAGE:$GITHUB_SHA" .
-      - name: Push image
-        run: docker push "$IMAGE:$GITHUB_SHA"
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ env.IMAGE }}:${{ github.sha }}
+          cache-from: type=gha,scope=anouma-image
+          cache-to: type=gha,mode=max,scope=anouma-image
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index 317fa0e..4120eb5 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -193,7 +193,7 @@ See `.env.example` for the full, commented list. `setup.sh` writes the real file
 | `TURNSTILE_SITE_KEY` | Public Cloudflare Turnstile site key |
 | `TURNSTILE_SECRET_KEY` | Server-only Cloudflare Turnstile secret; keep it in `/opt/anouma/.env` and never in GitHub Actions or the repository |
 | `TURNSTILE_HOSTNAMES` | Hostnames accepted by Siteverify; production is `anouma.org` only (local development may use `localhost,127.0.0.1`) |
-| `SMTP_*` | The existing ANOUMA mail system |
+| `SMTP_*` | The existing ANOUMA mail system. `SMTP_TLS_REJECT_UNAUTHORIZED` stays `true` unless the configured SMTP proxy intentionally uses a private/self-signed certificate; only then set it to `false`. |
 | `INBOUND_REPLY_TO`, `INBOUND_EMAIL_SECRET` | Mailbox and shared secret for the inbound email webhook (`/api/email/inbound`) |
 | `LIVEKIT_URL`, `LIVEKIT_API_KEY`, `LIVEKIT_API_SECRET` | eigener LiveKit-SFU und serverseitige Token-Erzeugung |
 | `DOCKER_NETWORK`, `NPM_NETWORK` | Docker network names |
diff --git a/lib/email/transport.ts b/lib/email/transport.ts
index 99d5acd..b0b898c 100644
--- a/lib/email/transport.ts
+++ b/lib/email/transport.ts
@@ -15,6 +15,12 @@ export function getMailTransport(): nodemailer.Transporter {
     host: SMTP_HOST,
     port: Number(SMTP_PORT),
     secure: Number(SMTP_PORT) === 465,
+    tls: {
+      // Keep certificate verification enabled by default. A private SMTP
+      // proxy may expose a self-signed certificate; that deployment can
+      // explicitly opt out without weakening unrelated HTTPS requests.
+      rejectUnauthorized: process.env.SMTP_TLS_REJECT_UNAUTHORIZED !== "false",
+    },
     connectionTimeout: 10000,
     greetingTimeout: 10000,
     socketTimeout: 20000,
diff --git a/setup.sh b/setup.sh
index c131c2a..588b396 100755
--- a/setup.sh
+++ b/setup.sh
@@ -313,6 +313,7 @@ SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM=
+SMTP_TLS_REJECT_UNAUTHORIZED=true
 INBOUND_REPLY_TO=reply-to@anouma.org
 INBOUND_EMAIL_SECRET=
 LIVEKIT_URL=