docs: credentials.md for git/mailbox creds, notify-creds, and SMTP ports

New docs/credentials.md covers member git-account provisioning, the
notify-creds backfill command (flags + behavior), required env, and the
two SMTP paths — transactional AGENTBBS_SMTP_* (STARTTLS :587) vs. the
gateway loopback relay AGENTBBS_MAIL_SMTP_ADDR (:25 into Mailu),
clarifying why :25 is correct and that 465 (not "467") is implicit-TLS.

Cross-linked from README ops and docs/mail.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-23 10:48:36 +00:00
parent 95d1afb59a
commit 11503ca3f0
3 changed files with 105 additions and 0 deletions

View file

@ -103,6 +103,13 @@ Without `AGENTBBS_MAIL_API_TOKEN` auto-provisioning is skipped (the address is
still shown); without `AGENTBBS_MAIL_MASTER_PASS` the gateway can't open
mailboxes.
> **`AGENTBBS_MAIL_SMTP_ADDR` is `127.0.0.1:25` on purpose** — it's the gateway's
> *loopback* hand-off into the on-box Mailu/Postfix MTA, not a remote submission
> client, so `25` is correct (465/587 are for authenticated remote clients).
> This is a separate config from `AGENTBBS_SMTP_*` (the transactional sender for
> confirmation codes and `notify-creds`, which defaults to STARTTLS `:587`). See
> [`credentials.md`](credentials.md#two-smtp-paths-and-why-one-is-25).
### Why the gateway talks to Dovecot directly (plaintext loopback)
Mailu's **front** (nginx mail proxy) pre-authenticates every IMAP/SMTP login