From d16a1a058e282bfe69cce3d772c5aa8788286fe7 Mon Sep 17 00:00:00 2001
From: Felix Kemmler <felix_kemmler@protonmail.com>
Date: Mon, 10 Aug 2026 21:46:29 +0200
Subject: [PATCH] Add SMTP email configuration via .env for password reset mail
 delivery
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- docker-compose.yml: Add Email__* vars for SMTP provider, host, credentials, and reset template (all referencing env vars from .env)
- .env (new, gitignored): Real SMTP credentials for passwort@omsorg-pflegedienste.de
- .env.example (new, tracked): Template documenting required env vars for next deploy
- .gitignore: Add .env to gitignore so credentials don't leak into git history

Mailversand über den bestehenden `SmtpEmailSender` (`omsorgCore/CLAUDE.md`, Abschnitt "Passwort-Reset / E-Mail-Versand") wird damit in Docker Compose aktiviert — zuvor war nur der Console-Provider (kein echter Versand) konfiguriert.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 .env.example       | 12 ++++++++++++
 .gitignore         |  1 +
 docker-compose.yml |  8 ++++++++
 3 files changed, 21 insertions(+)
 create mode 100644 .env.example

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..bc59906
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,12 @@
+# Email configuration for SMTP-based password reset mail delivery
+# Copy this file to .env and fill in the actual values (especially EMAIL_PASSWORD_RESET_PASSWORD)
+# The .env file is loaded automatically by docker compose and is git-ignored to keep credentials safe
+
+EMAIL_PROVIDER=Smtp
+EMAIL_SMTP_HOST=smtps.udag.de
+EMAIL_SMTP_PORT=587
+EMAIL_PASSWORD_RESET_USERNAME=passwort@omsorg-pflegedienste.de
+EMAIL_PASSWORD_RESET_PASSWORD=
+EMAIL_PASSWORD_RESET_SENDER=passwort@omsorg-pflegedienste.de
+EMAIL_PASSWORD_RESET_SUBJECT=Ihr OMSORG Passwort-Reset-Code
+EMAIL_PASSWORD_RESET_BODY_TEMPLATE=Ihr Code lautet: $$RESET_PIN$$\nDer Code ist $$RESET_PIN_EXPIRY_MINUTES$$ Minuten gültig.
diff --git a/.gitignore b/.gitignore
index 89ac81e..30a67e9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 # Config with credentials
+.env
 **/mitarbeiter-app*/lib/config.php
 **/mitarbeiter-app*/lib/config.secret.php
 
diff --git a/docker-compose.yml b/docker-compose.yml
index dc39200..268f6b7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -75,6 +75,14 @@ services:
       ConnectionStrings__OmsorgCore: "Host=postgres;Port=5432;Database=omsorg_core;Username=omsorg_core;Password=omsorg_core_dev_password"
       Jwt__Secret: "CHANGE_ME_LOCAL_DEV_SECRET_MIN_32_CHARS_LONG"
       Cors__AllowedOrigins__0: "https://app.omsorg-pflegedienste.de"
+      Email__Provider: "${EMAIL_PROVIDER}"
+      Email__Smtp__Host: "${EMAIL_SMTP_HOST}"
+      Email__Smtp__Port: "${EMAIL_SMTP_PORT}"
+      Email__Accounts__PasswordReset__Username: "${EMAIL_PASSWORD_RESET_USERNAME}"
+      Email__Accounts__PasswordReset__Password: "${EMAIL_PASSWORD_RESET_PASSWORD}"
+      Email__Accounts__PasswordReset__SenderAddress: "${EMAIL_PASSWORD_RESET_SENDER}"
+      Email__PasswordResetTemplate__Subject: "${EMAIL_PASSWORD_RESET_SUBJECT}"
+      Email__PasswordResetTemplate__BodyTemplate: "${EMAIL_PASSWORD_RESET_BODY_TEMPLATE}"
     ports:
       # Nur auf dem Host erreichbar (für den Reverse-Proxy oben), nie auf der öffentlichen
       # Schnittstelle - matcht das 127.0.0.1:5173-Muster im bestehenden Host-nginx.