#18: implement SMTP Submission (587/465), SASL PLAIN/LOGIN auth and preflight diagnostics

.env.example

@@ -8,23 +8,65 @@ REDIS_PASSWORD=change-me-in-local-dev
 
 # --- Shared secrets (local dev values — never reuse in production) ---
 JWT_SECRET=local-dev-jwt-secret-change-me
+# Encrypts DKIM private keys and provider tokens at rest. Losing it makes every
+# stored secret unrecoverable — back it up separately from the database.
 LAMBDAMAIL_MASTER_KEY=local-dev-master-key-32-bytes-min
 
-# --- Cloudflare (optional in F0 — DNS automation lands in F3) ---
-CLOUDFLARE_API_TOKEN=
-
 # --- Host identity ---
 PRIMARY_MAIL_HOST=mail.localhost
+MAIL_DOMAIN=localhost
 PUBLIC_IPV4=127.0.0.1
 PUBLIC_IPV6=
 
-# --- TLS (F0 has no real certs — protocols stub reports degraded, never crashes) ---
+# --- DNS automation (Cloudflare) ---
+# The token needs Zone.DNS:Edit plus Zone.Zone:Read on the zone. Leave it empty
+# to disable reconciliation; the service then logs that DNS sync is off.
+CLOUDFLARE_API_TOKEN=
+DNS_SYNC_INTERVAL_SECONDS=21600
+
+# --- TLS ---
+# traefik: read the certificate Traefik manages (default, DANE not possible).
+# acme:    obtain the certificate ourselves via DNS-01. Required for DANE,
+#          because only this mode can reuse a pre-generated key.
 TLS_MODE=traefik
+# Used only when TLS_MODE=acme. Leave ACME_DIRECTORY_URL empty for Let's
+# Encrypt production; point it at the staging directory while testing, since
+# production rate limits can lock a domain out for a week.
+ACME_EMAIL=
+ACME_DIRECTORY_URL=
 COOLIFY_PROXY_DIR=./local/acme
+TRAEFIK_ACME_FILENAME=acme.json
+CERT_POLL_INTERVAL_SECONDS=60
+# Static certificate files, used when no ACME store is available (local dev).
 PROTOCOLS_CERT_PATH=/etc/lambdamail/certs/cert.pem
 PROTOCOLS_KEY_PATH=/etc/lambdamail/certs/key.pem
 PROTOCOLS_SPOOL_DIR=/var/lambdamail/spool
 
+# --- Transport security policy ---
+# Start at "testing": senders honour the policy but do not hard-fail on it.
+# Promote to "enforce" only once TLS-RPT reports come back clean.
+MTA_STS_MODE=testing
+OUTBOUND_MTA_STS_ENABLED=true
+# DANE stays off unless TLS_MODE=acme. Under Traefik-managed certificates the
+# key changes at every renewal and the published TLSA record stops matching,
+# which permanently rejects mail at every validating MTA.
+OUTBOUND_DANE_ENABLED=false
+DNSSEC_RESOLVER=1.1.1.1:53
+MAX_MESSAGE_BYTES=52428800
+
+# ARC seals accepted messages so a downstream receiver can still tell that the
+# mail authenticated at the first hop. Only worth enabling on a host that
+# forwards mail onward.
+ARC_SEAL_ENABLED=false
+
+# --- Smarthost (for hosts where outbound port 25 is blocked) ---
+# Setting RELAY_HOST routes all delivery through the relay and adds it to the
+# published SPF record, without which every relayed message fails SPF.
+RELAY_HOST=
+RELAY_PORT=587
+RELAY_USER=
+RELAY_PASS=
+
 # --- Webmail ---
 WEBMAIL_HOST=localhost:3000
 ADMIN_HOST=