From 648459f7ce04dcc5c6d57ebc9bce6ad6ffc25925 Mon Sep 17 00:00:00 2001
From: Erin of Yukis <erin-dev@ninetailed.ninja>
Date: Sun, 14 Dec 2025 23:16:02 +0100
Subject: [PATCH] Expose new `tlsMode` and `tlsVerify` options for connecting
 to the mail submission agent

---
 .env.sample               |  4 ++--
 bewcloud.config.sample.ts |  2 ++
 lib/config.ts             |  2 ++
 lib/models/email.ts       | 20 +++++++++++++++++---
 lib/types.ts              |  4 ++++
 5 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/.env.sample b/.env.sample
index 0a501ae..7111ba4 100644
--- a/.env.sample
+++ b/.env.sample
@@ -16,5 +16,5 @@ MFA_SALT="fake" # optional, if you want to enable multi-factor authentication
 OIDC_CLIENT_ID="fake" # optional, if you want to enable SSO (Single Sign-On)
 OIDC_CLIENT_SECRET="fake" # optional, if you want to enable SSO (Single Sign-On)
 
-SMTP_USERNAME="fake" # optional, if you want to enable signup email verification or multi-factor authentication via email
-SMTP_PASSWORD="fake" # optional, if you want to enable signup email verification or multi-factor authentication via email
+#SMTP_USERNAME=""  # optional, if you want to use signup email verification or multi-factor with an email service requiring authentication
+#SMTP_PASSWORD=""  # optional, if you want to use signup email verification or multi-factor with an email service requiring authentication
diff --git a/bewcloud.config.sample.ts b/bewcloud.config.sample.ts
index 6918864..c2bb6dc 100644
--- a/bewcloud.config.sample.ts
+++ b/bewcloud.config.sample.ts
@@ -32,6 +32,8 @@ const config: PartialDeep<Config> = {
   //   from: 'help@bewcloud.com',
   //   host: 'localhost',
   //   port: 465,
+  //   tlsMode: null,  // May be "immediate", "starttls" or "none", defaults to immediate TLS if port is 465, StartTLS otherwise
+  //   tlsVerify: true,  // Whether to verify the TLS certificate, if a string is used the hostname will be verified using that name
   // },
   // contacts: {
   //   enableCardDavServer: true,
diff --git a/lib/config.ts b/lib/config.ts
index b843111..731b254 100644
--- a/lib/config.ts
+++ b/lib/config.ts
@@ -37,6 +37,8 @@ export class AppConfig {
         from: 'help@bewcloud.com',
         host: 'localhost',
         port: 465,
+        tlsMode: null,  // Depends on the port number above
+        tlsVerify: true,
       },
       contacts: {
         enableCardDavServer: true,
diff --git a/lib/models/email.ts b/lib/models/email.ts
index 4b1afdf..4ab7a51 100644
--- a/lib/models/email.ts
+++ b/lib/models/email.ts
@@ -15,14 +15,28 @@ export class EmailModel {
       throw new Error('config.email.from, config.email.host, or config.email.port is not set');
     }
 
+    let tlsMode = emailConfig.tlsMode;
+    if (!["immediate", "starttls", "none"].includes(tlsMode)) {
+      tlsMode = Number(emailConfig.port) === 465 ? "immediate" : "starttls";
+    }
+
     const transporterConfig = {
       host: emailConfig.host,
       port: emailConfig.port,
-      secure: Number(emailConfig.port) === 465,
-      auth: {
+
+      secure: tlsMode === "immediate",
+      requireTLS: tlsMode === "starttls",
+      ignoreTLS: tlsMode === "none",
+      tls: (
+        emailConfig.tlsVerify === false ? { rejectUnauthorized: false } :
+        emailConfig.tlsVerify !== true  ? { servername: emailConfig.tlsVerify } :
+        {}
+      ),
+
+      auth: (SMTP_USERNAME || SMTP_PASSWORD) ? {
         user: SMTP_USERNAME,
         pass: SMTP_PASSWORD,
-      },
+      } : null,
     };
 
     const transporter = nodemailer.createTransport(transporterConfig);
diff --git a/lib/types.ts b/lib/types.ts
index 04dd1a3..9952c2b 100644
--- a/lib/types.ts
+++ b/lib/types.ts
@@ -206,6 +206,10 @@ export interface Config {
     host: string;
     /** The SMTP port to send emails from */
     port: number;
+    /** How to use TLS when connecting: default is “immediate” on port 465, “starttls” otherwise */
+    tlsMode: null | "immediate" | "starttls" | "none";
+    /** Whether to verify the TLS certificate, if a string is used the hostname will be verified using that name */
+    tlsVerify: boolean | string;
   };
   contacts: {
     /** If true, the CardDAV server will be enabled (proxied) */