v1.0.44 — Explicit SMTP security

Addresses issue #41.
SMTP encryption is now explicitly configured independently of authentication and port.

What changed

• SMTP_SECURITY=starttls (default) requires a successful TLS upgrade before authentication or delivery.
• SMTP_SECURITY=tls supports implicit TLS (typically port 465).
• SMTP_SECURITY=none explicitly selects an unencrypted connection.
• SMTP_USER and SMTP_PASSWORD are optional but must both be set or both be empty.
• Server certificates and hostnames remain verified. SMTP_CA_BUNDLE optionally adds private CA certificates. TLS failures never fall back to plaintext.
• Configuration validation errors hide settings inputs to avoid exposing secrets in startup logs.
• Environment examples and guides explain encryption, authentication, certificate trust, and failure behavior. See SMTP setup.

Before upgrading

Previously, an empty SMTP_USER disabled STARTTLS. Existing unauthenticated
plaintext relays must explicitly set SMTP_SECURITY=none, or enable STARTTLS.
Authenticated STARTTLS configurations retain their behavior. Invalid security
modes or incomplete credential pairs prevent startup. Set the port separately;
port selection does not select the encryption mode. Private CA files must be
mounted read-only into the API container at the configured path.

No database migrations are introduced. Client-certificate authentication is not
included in this release.

Images and upgrade

Production images target linux/amd64:

• ghcr.io/socfortress/waf-caddy:1.0.44
• ghcr.io/socfortress/waf-admin-api:1.0.44
• ghcr.io/socfortress/waf-admin-ui:1.0.44

Back up the database, configuration, certificate storage, and deployment settings. Preserve local Compose overrides. If upgrading from v1.0.40 or older, review the v1.0.41 security changes, v1.0.40 certificate persistence migration, and any earlier applicable release prerequisites.

Update deployment files with git pull --ff-only, preserving customizations, and set both values in .env:

WAF_IMAGE_TAG=1.0.44
CRS_CADDY_DIGEST=sha256:63a127d28cc2e919fb6c334dcaa42ec4cff2162835423874a241d883cf7f212e

The digest takes precedence over the tag. Production Caddy and the CRS validator must use the same release digest. Verify docker compose config, stop configuration edits, and upgrade the services together:

docker compose pull
docker compose stop admin-ui admin-api caddy-waf waf-sandbox
docker compose up -d --wait postgres redis http-echo caddy-waf waf-sandbox
docker compose up -d --wait admin-api admin-ui
docker compose ps

After upgrading, check About → Version shows v1.0.44, then use the email
channel test to verify delivery. Existing installations with update checks enabled
discover this release on their next cached check (up to 6 hours).

Validation

• 79 SMTP and alert tests passed against current release dependencies, including aiosmtplib 5.1.3.
• Eleven integration cases use real loopback SMTP/TLS connections: delivery with and without authentication, explicit plaintext, private CA trust, untrusted and hostname-mismatched certificate rejection, and failure when STARTTLS is unavailable.
• No external provider delivery was attempted. Three existing AsyncMock warnings remain in alert tests.
• git diff --check passed.
• All three Linux/amd64 publication jobs succeeded; anonymous manifest/config access, source revision, version labels, and matching latest/1.0 aliases were verified.
• Published API image smoke test passed with networking disabled: version 1.0.44, SMTP security configuration, and settings error redaction.
• Public Compose configuration resolves to the release images with matching production Caddy and CRS validator digest pins.

Images are built from merged source 564176023ee4666780e09d415f19355fac91b0a3.
See publication verification
for image digests, platforms, source revisions, and anonymous registry access.

Rollback

There are no schema changes. Restore the previous deployment settings and use
the same service upgrade sequence with:

WAF_IMAGE_TAG=1.0.43
CRS_CADDY_DIGEST=sha256:af5e2f714794fb069baf7a3cec71018f9d3a99f8e868d604dc15fcfd3d089313

v1.0.43 does not support the new SMTP settings: it requires STARTTLS when a username
is present and otherwise sends plaintext. Restore a compatible relay configuration
before rolling back; implicit TLS-only setups will not work on that version.

Publishing this release does not upgrade existing servers automatically.