awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(smtp-service): Custom CA Certs

Browse Source
This commit is contained in:
x032205
2025-05-23 03:19:45 -04:00
parent 424e4670e5
commit 65bc522ae9
2 changed files with 34 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
backend/src/lib/config/env.ts
View File

@@ -69,6 +69,9 @@ const envSchema = z
SMTP_PASSWORD: zpStr(z.string().optional()),
SMTP_FROM_ADDRESS: zpStr(z.string().optional()),
SMTP_FROM_NAME: zpStr(z.string().optional().default("Infisical")),
SMTP_CUSTOM_CA_CERT: zpStr(
z.string().optional().describe("PEM-encoded custom CA certificate(s) for the SMTP server")
),
COOKIE_SECRET_SIGN_KEY: z
.string()
.min(32)
@@ -298,6 +301,17 @@ export const initEnvConfig = (logger?: CustomLogger) => {
};
export const formatSmtpConfig = () => {
const tlsOptions: {
rejectUnauthorized: boolean;
ca?: string | string[];
} = {
rejectUnauthorized: envCfg.SMTP_TLS_REJECT_UNAUTHORIZED
};
if (envCfg.SMTP_CUSTOM_CA_CERT) {
tlsOptions.ca = envCfg.SMTP_CUSTOM_CA_CERT;
}
return {
host: envCfg.SMTP_HOST,
port: envCfg.SMTP_PORT,
@@ -309,8 +323,6 @@ export const formatSmtpConfig = () => {
from: `"${envCfg.SMTP_FROM_NAME}" <${envCfg.SMTP_FROM_ADDRESS}>`,
ignoreTLS: envCfg.SMTP_IGNORE_TLS,
requireTLS: envCfg.SMTP_REQUIRE_TLS,
tls: {
rejectUnauthorized: envCfg.SMTP_TLS_REJECT_UNAUTHORIZED
}
tls: tlsOptions
};
};

25
docs/self-hosting/configuration/envars.mdx
View File

@@ -32,7 +32,7 @@ Used to configure platform-specific security and operational settings
<ParamField query="HOST" type="string" default="localhost" optional>
Specifies the network interface Infisical will bind to when accepting incoming connections.
By default, Infisical binds to `localhost`, which restricts access to connections from the same machine.
By default, Infisical binds to `localhost`, which restricts access to connections from the same machine.
To make the application accessible externally (e.g., for self-hosted deployments), set this to `0.0.0.0`, which tells the server to listen on all network interfaces.
@@ -95,7 +95,7 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
</ParamField>
<ParamField query="DB_ROOT_CERT" type="string" default="" optional>
Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
Use the command below to encode your certificate:
`echo "<certificate>" | base64`
</ParamField>
@@ -222,7 +222,7 @@ SMTP_FROM_NAME=Infisical
This will be used to verify the email you are sending from.
![Create SES identity](../../images/self-hosting/configuration/email/ses-create-identity.png)
<Info>
If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies.
If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies.
</Info>
</Step>
<Step title="Create an account and configure AWS SES">
@@ -388,9 +388,9 @@ SMTP_FROM_NAME=Infisical
</Info>
</Accordion>
<Accordion title="SMTP2Go">
<Accordion title="SMTP2Go">
1. Create an account and configure [SMTP2Go](https://www.smtp2go.com/) to send emails.
2. Turn on SMTP authentication
2. Turn on SMTP authentication
```
SMTP_HOST=mail.smtp2go.com
SMTP_PORT=You can use one of the following ports: 2525, 80, 25, 8025, or 587
@@ -401,7 +401,7 @@ SMTP_FROM_NAME=Infisical
```
{" "}
<Note>
<Note>
Optional (for TLS/SSL):
TLS: Available on the same ports (2525, 80, 25, 8025, or 587)
@@ -410,6 +410,19 @@ SSL: Available on ports 465, 8465, and 443
</Note>
</Accordion>
### Custom CA Certificate for Email Service TLS
If your SMTP server uses a certificate signed by a custom Certificate Authority, you need to tell Infisical to trust this custom CA. To do this, set the following environment variables:
```
SMTP_PORT=465 # Or your SMTPS/STARTTLS port
SMTP_CUSTOM_CA_CERT='[CERTIFICATE PEM]'
# Always keep these as true for custom CA
SMTP_REQUIRE_TLS=true
SMTP_TLS_REJECT_UNAUTHORIZED=true
```
## Authentication
By default, users can only login via email/password based login method.