fix: load SMTP via secret files on submissions:465

Env-based notifier creds were unreliable; use secrets/smtp_*.txt, RFC5322 sender, and implicit TLS to 0012.de Plesk.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -1,15 +1,16 @@
 # Copy to .env on the deploy host. Never commit .env.
-# SMTP values: same as ~/git/froxxxy/0012/server.env (Plesk mail)
 
 TZ=Europe/Berlin
 
-# --- Authelia crypto (generate on deploy; see README) ---
+# Optional: Authelia log level (info|debug|trace)
-# Prefer secret files under ./secrets/ (recommended). If you use env instead:
+# AUTHELIA_LOG_LEVEL=info
-# AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=
-# AUTHELIA_SESSION_SECRET=
-# AUTHELIA_STORAGE_ENCRYPTION_KEY=
 
-# --- SMTP (0012.de Plesk) ---
+# --- SMTP credentials (0012.de Plesk) ---
-AUTHELIA_NOTIFIER_SMTP_USERNAME=admin@0012.de
+# Authelia reads these from secret files (not from env):
-AUTHELIA_NOTIFIER_SMTP_PASSWORD=
+#   secrets/smtp_username.txt   e.g. auth@0012.de
-AUTHELIA_NOTIFIER_SMTP_SENDER=Authelia <monitor@0012.de>
+#   secrets/smtp_password.txt
+#   secrets/smtp_sender.txt     e.g. Authelia <auth@0012.de>
+# Create them on the server (see README). Keep this .env for your own notes if useful:
+SMTP_USER=auth@0012.de
+SMTP_PASSWORD=
+SMTP_SENDER=Authelia <auth@0012.de>

README.md

@@ -40,8 +40,8 @@ Zusätzlich in diesem Repo unter `config/configuration.yml` → `access_control.
 | `compose.yml` | Authelia, Redis, whoami-Smoke |
 | `config/configuration.yml` | Authelia-Config (kein Secret-Inhalt) |
 | `config/users_database.yml.example` | User-Template |
-| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt` (nur auf dem Server) |
+| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt`, `smtp_username.txt`, `smtp_password.txt`, `smtp_sender.txt` (nur auf dem Server) |
-| `.env` | SMTP + TZ (nur auf dem Server) |
+| `.env` | `TZ` (+ optional Log-Level); SMTP-Passwort gehört in `secrets/smtp_*.txt` |
 
 ## Deploy (boka)
 
@@ -65,6 +65,18 @@ docker run --rm -u 8000:8000 -v "$(pwd)/secrets:/secrets" authelia/authelia:4.39
     session_secret.txt storage_encryption_key.txt jwt_secret.txt'
 ```
 
+SMTP (0012.de) — Dateien unter `secrets/` (UID 8000):
+
+```bash
+# as root / via docker if secrets/ is 0700 for uid 8000
+printf '%s\n' 'auth@0012.de' > secrets/smtp_username.txt
+printf '%s\n' 'YOUR_SMTP_PASSWORD' > secrets/smtp_password.txt
+printf '%s\n' 'Authelia <auth@0012.de>' > secrets/smtp_sender.txt
+chown 8000:8000 secrets/smtp_*.txt && chmod 600 secrets/smtp_*.txt
+```
+
+Notifier: `submissions://ha01s019.org-dns.com:465` (implizites TLS). Sender-Format muss RFC5322 sein: `Name <user@domain>` — kein unquoted `foo.bar.baz <…>`.
+
 ### User-DB
 
 ```bash
@@ -84,11 +96,10 @@ docker compose logs -f authelia
 
 ## SMTP (0012.de)
 
-Notifier nutzt Plesk-SMTP wie in `0012` Todo 11 / `server.env`:
+- Host `ha01s019.org-dns.com`, Port **465** (`submissions://`), Auth z.B. `auth@0012.de`
-
+- Credentials nur in `secrets/smtp_*.txt` (siehe oben)
-- Host `ha01s019.org-dns.com`, Port `587` (STARTTLS / `submission://`)
+- Startup-Check sendet **keine** Mail — nur Verbindungs-Check
-- Login `admin@0012.de`, From z.B. `Authelia <monitor@0012.de>`
+- Test von boka: Python/`swaks` an `cuidas@gmail.com`; Authelia-Logs bei Erfolg: Trace `Timing Attack Delay successful: true` nach „Sending an email…“
-- Passwort nur in `.env` als `AUTHELIA_NOTIFIER_SMTP_PASSWORD`
 
 ## TOTP-Enrollment
 

compose.yml

@@ -14,9 +14,7 @@ services:
     environment:
       TZ: ${TZ:-Europe/Berlin}
       X_AUTHELIA_CONFIG_FILTERS: template
-      AUTHELIA_NOTIFIER_SMTP_USERNAME: ${AUTHELIA_NOTIFIER_SMTP_USERNAME}
+      AUTHELIA_LOG_LEVEL: ${AUTHELIA_LOG_LEVEL:-info}
-      AUTHELIA_NOTIFIER_SMTP_PASSWORD: ${AUTHELIA_NOTIFIER_SMTP_PASSWORD}
-      AUTHELIA_NOTIFIER_SMTP_SENDER: ${AUTHELIA_NOTIFIER_SMTP_SENDER}
     labels:
       - traefik.enable=true
       - traefik.docker.network=traefik

config/configuration.yml

@@ -1,6 +1,6 @@
 ---
 # Authelia configuration — secrets via template files under /secrets/
-# SMTP username/password/sender come from environment (see compose.yml / .env)
+# SMTP username/password/sender: files in /secrets/smtp_*.txt (see README)
 
 server:
   address: 'tcp://:9091'
@@ -73,10 +73,14 @@ storage:
 notifier:
   disable_startup_check: false
   smtp:
-    address: 'submission://ha01s019.org-dns.com:587'
+    address: 'submissions://ha01s019.org-dns.com:465'
-    timeout: '10s'
+    timeout: '15s'
+    username: {{ secret "/secrets/smtp_username.txt" | mindent 0 "|" | msquote }}
+    password: {{ secret "/secrets/smtp_password.txt" | mindent 0 "|" | msquote }}
+    sender: {{ secret "/secrets/smtp_sender.txt" | mindent 0 "|" | msquote }}
+    identifier: 'auth.schwenk.online'
     subject: '[Authelia] {title}'
     startup_check_address: 'cuidas@gmail.com'
     disable_require_tls: false
     disable_starttls: false
-    # username, password, sender: AUTHELIA_NOTIFIER_SMTP_* from environment
+    disable_html_emails: false