Fix SMTP proxy certificates and speed up CI

.env.example

@@ -58,6 +58,9 @@ SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM="ANOUMA <support@anouma.org>"
+# Keep true for publicly trusted SMTP certificates. Set false only when the
+# configured SMTP proxy intentionally uses a private/self-signed certificate.
+SMTP_TLS_REJECT_UNAUTHORIZED=true
 
 # Address used as Reply-To for CMS replies. Configure this mailbox with an
 # inbound provider/webhook that POSTs replies to /api/email/inbound.

.github/workflows/ci.yml

@@ -35,16 +35,13 @@ jobs:
         run: npx next typegen && npx tsc --noEmit
       - name: Test
         run: npm test
-      - name: Build
-        env:
-          NODE_ENV: production
-        run: npm run build
 
   build-image:
     needs: test
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     runs-on: ubuntu-latest
     permissions:
+      actions: write
       contents: read
       packages: write
     env:
@@ -58,7 +55,13 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build image
-        run: docker build -t "$IMAGE:$GITHUB_SHA" .
-      - name: Push image
-        run: docker push "$IMAGE:$GITHUB_SHA"
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ env.IMAGE }}:${{ github.sha }}
+          cache-from: type=gha,scope=anouma-image
+          cache-to: type=gha,mode=max,scope=anouma-image

DEPLOYMENT.md

@@ -193,7 +193,7 @@ See `.env.example` for the full, commented list. `setup.sh` writes the real file
 | `TURNSTILE_SITE_KEY` | Public Cloudflare Turnstile site key |
 | `TURNSTILE_SECRET_KEY` | Server-only Cloudflare Turnstile secret; keep it in `/opt/anouma/.env` and never in GitHub Actions or the repository |
 | `TURNSTILE_HOSTNAMES` | Hostnames accepted by Siteverify; production is `anouma.org` only (local development may use `localhost,127.0.0.1`) |
-| `SMTP_*` | The existing ANOUMA mail system |
+| `SMTP_*` | The existing ANOUMA mail system. `SMTP_TLS_REJECT_UNAUTHORIZED` stays `true` unless the configured SMTP proxy intentionally uses a private/self-signed certificate; only then set it to `false`. |
 | `INBOUND_REPLY_TO`, `INBOUND_EMAIL_SECRET` | Mailbox and shared secret for the inbound email webhook (`/api/email/inbound`) |
 | `LIVEKIT_URL`, `LIVEKIT_API_KEY`, `LIVEKIT_API_SECRET` | eigener LiveKit-SFU und serverseitige Token-Erzeugung |
 | `DOCKER_NETWORK`, `NPM_NETWORK` | Docker network names |

lib/email/transport.ts

@@ -15,6 +15,12 @@ export function getMailTransport(): nodemailer.Transporter {
     host: SMTP_HOST,
     port: Number(SMTP_PORT),
     secure: Number(SMTP_PORT) === 465,
+    tls: {
+      // Keep certificate verification enabled by default. A private SMTP
+      // proxy may expose a self-signed certificate; that deployment can
+      // explicitly opt out without weakening unrelated HTTPS requests.
+      rejectUnauthorized: process.env.SMTP_TLS_REJECT_UNAUTHORIZED !== "false",
+    },
     connectionTimeout: 10000,
     greetingTimeout: 10000,
     socketTimeout: 20000,

setup.sh

@@ -313,6 +313,7 @@ SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM=
+SMTP_TLS_REJECT_UNAUTHORIZED=true
 INBOUND_REPLY_TO=reply-to@anouma.org
 INBOUND_EMAIL_SECRET=
 LIVEKIT_URL=