refactor: use filesystem notifier instead of SMTP

Solo-admin setup; enrollment codes in config/notification.txt. Drop 0012 SMTP/secret files.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -4,13 +4,3 @@ TZ=Europe/Berlin
 
 # Optional: Authelia log level (info|debug|trace)
 # AUTHELIA_LOG_LEVEL=info
-
-# --- SMTP credentials (0012.de Plesk) ---
-# Authelia reads these from secret files (not from env):
-#   secrets/smtp_username.txt   e.g. auth@0012.de
-#   secrets/smtp_password.txt
-#   secrets/smtp_sender.txt     e.g. Authelia <auth@0012.de>
-# Create them on the server (see README). Keep this .env for your own notes if useful:
-SMTP_USER=auth@0012.de
-SMTP_PASSWORD=
-SMTP_SENDER=Authelia <auth@0012.de>

NOTES.md

@@ -4,7 +4,9 @@ Scratchpad for this project.
 
 ---
 
-## 2026-08-01 — Repo ready, not deployed
+## 2026-08-01
 
-- Stack files in place; `authelia validate-config` OK with template secrets + SMTP env.
+- SMTP verworfen (Authelia Send „OK“, Gmail bekam Authelia-Mails nicht; Control-Mails sonst ok).
-- Next (Fränky): DNS, `.env` SMTP from 0012, secrets generate, `users_database.yml`, deploy to `/home/frank/auth.schwenk.online`.
+- Notifier: filesystem → `config/notification.txt`
+- TOTP/Google Authenticator verknüpft.
+- Mail-Konto `auth@0012.de` darf weg.

README.md

@@ -40,8 +40,9 @@ Zusätzlich in diesem Repo unter `config/configuration.yml` → `access_control.
 | `compose.yml` | Authelia, Redis, whoami-Smoke |
 | `config/configuration.yml` | Authelia-Config (kein Secret-Inhalt) |
 | `config/users_database.yml.example` | User-Template |
-| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt`, `smtp_username.txt`, `smtp_password.txt`, `smtp_sender.txt` (nur auf dem Server) |
+| `config/notification.txt` | Filesystem-Notifier-Ausgabe (gitignored, nur Server) |
-| `.env` | `TZ` (+ optional Log-Level); SMTP-Passwort gehört in `secrets/smtp_*.txt` |
+| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt` (nur auf dem Server) |
+| `.env` | `TZ` (+ optional Log-Level) |
 
 ## Deploy (boka)
 
@@ -52,7 +53,6 @@ ssh frank-schwenk.de
 git clone ssh://git@gitea.schwenk.online:2222/froxxxy/authschwenkonline.git /home/frank/auth.schwenk.online
 cd /home/frank/auth.schwenk.online
 cp .env.example .env
-# SMTP_PASSWORD und Sender aus 0012 server.env eintragen
 ```
 
 ### Secrets erzeugen
@@ -65,18 +65,6 @@ docker run --rm -u 8000:8000 -v "$(pwd)/secrets:/secrets" authelia/authelia:4.39
     session_secret.txt storage_encryption_key.txt jwt_secret.txt'
 ```
 
-SMTP (0012.de) — Dateien unter `secrets/` (UID 8000):
-
-```bash
-# as root / via docker if secrets/ is 0700 for uid 8000
-printf '%s\n' 'auth@0012.de' > secrets/smtp_username.txt
-printf '%s\n' 'YOUR_SMTP_PASSWORD' > secrets/smtp_password.txt
-printf '%s\n' 'Authelia <auth@0012.de>' > secrets/smtp_sender.txt
-chown 8000:8000 secrets/smtp_*.txt && chmod 600 secrets/smtp_*.txt
-```
-
-Notifier: `submissions://ha01s019.org-dns.com:465` (implizites TLS). Sender-Format muss RFC5322 sein: `Name <user@domain>` — kein unquoted `foo.bar.baz <…>`.
-
 ### User-DB
 
 ```bash
@@ -84,7 +72,7 @@ cp config/users_database.yml.example config/users_database.yml
 docker run --rm authelia/authelia:4.39 \
   authelia crypto hash generate argon2 --password 'YOUR_PASSWORD'
 # Hash in users_database.yml bei frank.password einsetzen
-# email: Postfach, das Mail von 0012.de SMTP annimmt (Tuta oft problematisch)
+# email: beliebig (Notifier schreibt lokal, kein SMTP)
 ```
 
 ### Start
@@ -94,25 +82,27 @@ docker compose up -d
 docker compose logs -f authelia
 ```
 
-## SMTP (0012.de)
+## Notifier (filesystem)
 
-- Host `ha01s019.org-dns.com`, Port **465** (`submissions://`), Auth z.B. `auth@0012.de`
+Codes / Reset-Links landen in `config/notification.txt` auf dem Server:
-- Credentials nur in `secrets/smtp_*.txt` (siehe oben)
+
-- Startup-Check sendet **keine** Mail — nur Verbindungs-Check
+```bash
-- Test von boka: Python/`swaks` an `cuidas@gmail.com`; Authelia-Logs bei Erfolg: Trace `Timing Attack Delay successful: true` nach „Sending an email…“
+ssh frank-schwenk.de
+# config/ is often root-owned after first start:
+docker run --rm -v /home/frank/auth.schwenk.online/config:/config:ro alpine cat /config/notification.txt
+```
 
 ## TOTP-Enrollment
 
 1. `https://auth.schwenk.online` öffnen, einloggen
-2. Enrollment-Code kommt per Mail
+2. Gerät registrieren → Code/Link aus `notification.txt` (siehe oben)
 3. QR mit Google Authenticator (o.ä.) scannen
 
 ## Verify
 
 1. Portal erreichbar: `https://auth.schwenk.online`
 2. Smoke hinter 2FA: `https://whoami-auth.schwenk.online` → Login + TOTP → whoami-Body
-3. Mail-Test: Passwort-Reset oder Enrollment löst SMTP aus
+3. `docker compose ps` — alle Services `running`
-4. `docker compose ps` — alle Services `running`
 
 whoami nach dem Smoke optional aus `compose.yml` entfernen oder Router-Label deaktivieren.
 

SOUL.md

@@ -32,7 +32,7 @@ Fränky (Admin); später ggf. weitere User in der File-DB. Consumer-Projekte (z.
 ## Project-Specific Rules
 
 - Secrets nur in `.env` / `secrets/` auf dem Server — nie committen
-- SMTP über 0012.de-Plesk (siehe README) — Passwort aus 0012 `server.env` kopieren
+- Notifier: filesystem (`config/notification.txt`) — kein SMTP
 - Middleware-Referenz für Consumer: `authelia@docker`
 - ACL: neue geschützte Hosts hier ergänzen (`two_factor` o.ä.), Middleware setzt das App-Repo
 

config/configuration.yml

@@ -1,6 +1,6 @@
 ---
 # Authelia configuration — secrets via template files under /secrets/
-# SMTP username/password/sender: files in /secrets/smtp_*.txt (see README)
+# Notifier: filesystem (solo admin; codes in /config/notification.txt)
 
 server:
   address: 'tcp://:9091'
@@ -72,15 +72,5 @@ storage:
 
 notifier:
   disable_startup_check: false
-  smtp:
+  filesystem:
-    address: 'submissions://ha01s019.org-dns.com:465'
+    filename: '/config/notification.txt'
-    timeout: '15s'
-    username: {{ secret "/secrets/smtp_username.txt" | mindent 0 "|" | msquote }}
-    password: {{ secret "/secrets/smtp_password.txt" | mindent 0 "|" | msquote }}
-    sender: {{ secret "/secrets/smtp_sender.txt" | mindent 0 "|" | msquote }}
-    identifier: 'auth.schwenk.online'
-    subject: '[Authelia] {title}'
-    startup_check_address: 'cuidas@gmail.com'
-    disable_require_tls: false
-    disable_starttls: false
-    disable_html_emails: false

config/users_database.yml.example

@@ -3,12 +3,12 @@
 # Generate hash:
 #   docker run --rm authelia/authelia:4.39 authelia crypto hash generate argon2 --password 'YOUR_PASSWORD'
 #
-# Use an email inbox that accepts mail from 0012.de SMTP (Tuta may reject).
+# email: placeholder (filesystem notifier — no real mailbox required)
 
 users:
   frank:
     displayname: 'Fränky'
     password: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_REAL_HASH'
-    email: 'cuidas@gmail.com'
+    email: 'frank@schwenk.online'
     groups:
       - 'admins'