fix(email): explicit TLS mode for non-standard relay ports

The 465-only implicit-TLS heuristic mis-classified Selectel's SSL port (1127),
which the mailer would have dialled with STARTTLS and failed. Add BACKEND_SMTP_TLS
(ssl|starttls) — empty still derives the mode from the port (implicit on 465, else
STARTTLS) — and dial implicit TLS with WithSSL()+WithPort so any port works, not
just 465. Wire SMTP_RELAY_TLS through compose/ci/prod/.env.example and document it
(Selectel: 1127 = SSL, 1126 = STARTTLS). Unit-tested.

backend/README.md

@@ -215,7 +215,8 @@ internal/banview/    # gateway active-ban mirror: the console's Active IP bans p
 | `BACKEND_LOBBY_REAPER_INTERVAL` | `1s` | How often the substitution reaper scans for over-waited players. |
 | `BACKEND_ROBOT_DRIVE_INTERVAL` | `30s` | How often the robot driver scans for due robot turns. |
 | `BACKEND_SMTP_HOST` | — | Confirm-code relay host. **Empty selects the development log mailer** (the code is logged, not sent). |
-| `BACKEND_SMTP_PORT` | `587` | Relay port. `465` selects implicit TLS; any other port uses STARTTLS. No client certificate is needed (the server cert is validated against the system roots). |
+| `BACKEND_SMTP_PORT` | `587` | Relay port. No client certificate is needed (the server cert is validated against the system roots). |
+| `BACKEND_SMTP_TLS` | — | Transport security: `ssl` (implicit TLS from connect) or `starttls`. Empty derives it from the port (implicit on `465`, STARTTLS otherwise); set it for a relay on a non-standard port (e.g. Selectel's `1127` = SSL, `1126` = STARTTLS). |
 | `BACKEND_SMTP_USERNAME` | — | SMTP AUTH user; empty relays without authentication. |
 | `BACKEND_SMTP_PASSWORD` | — | SMTP AUTH password. |
 | `BACKEND_SMTP_FROM` | `no-reply@localhost` | From address. A deployed contour must use the prod domain (the relay only accepts its verified sender domain). |

backend/internal/account/mailer.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/wneessen/go-mail"
@@ -31,27 +32,46 @@ type Mailer interface {
 // SMTPConfig configures the SMTP relay. An empty Host selects the LogMailer
 // instead, so a deployment without a relay still runs (the code lands in the log).
 // TLS is always used and no client certificate is required — only the server
-// certificate is validated against the system roots. The Port selects the TLS
-// mode: smtpImplicitTLSPort (465) uses implicit TLS (SSL); any other port uses
-// mandatory STARTTLS.
+// certificate is validated against the system roots.
 type SMTPConfig struct {
 	Host     string
 	Port     string
 	Username string
 	Password string
 	From     string
+	// TLS selects the transport security: "ssl" for implicit TLS from connect, or
+	// "starttls" to upgrade a plaintext connection. Empty derives the mode from the
+	// port (implicit TLS on 465, STARTTLS otherwise); set it explicitly for a relay on
+	// a non-standard port (e.g. Selectel's 1127 = SSL, 1126 = STARTTLS).
+	TLS string
 }
 
 const (
-	// smtpImplicitTLSPort is the port on which the relay is dialled with implicit
-	// TLS (SSL). Any other port negotiates mandatory STARTTLS instead.
-	smtpImplicitTLSPort = 465
+	// SMTP transport-security modes for SMTPConfig.TLS.
+	smtpTLSImplicit = "ssl"
+	smtpTLSSTARTTLS = "starttls"
 	// smtpDialTimeout bounds a single relay connect-and-send. The confirm-code send
 	// is synchronous on the request path, so an unreachable relay must fail fast
 	// rather than hold the request open.
 	smtpDialTimeout = 15 * time.Second
 )
 
+// tlsMode resolves the transport-security mode for the relay: the explicitly
+// configured SMTPConfig.TLS, or — when unset — implicit TLS on the conventional SSL
+// port 465 and STARTTLS on any other port.
+func (cfg SMTPConfig) tlsMode(port int) string {
+	switch strings.ToLower(strings.TrimSpace(cfg.TLS)) {
+	case smtpTLSImplicit, "tls":
+		return smtpTLSImplicit
+	case smtpTLSSTARTTLS:
+		return smtpTLSSTARTTLS
+	}
+	if port == 465 {
+		return smtpTLSImplicit
+	}
+	return smtpTLSSTARTTLS
+}
+
 // SMTPMailer sends mail through an SMTP relay using go-mail. When a username is
 // set it authenticates, auto-discovering the strongest mechanism the relay
 // advertises; otherwise it relays unauthenticated.
@@ -72,11 +92,11 @@ func (m SMTPMailer) Send(ctx context.Context, msg Message) error {
 	if err != nil {
 		return fmt.Errorf("account: invalid SMTP port %q: %w", m.cfg.Port, err)
 	}
-	opts := []mail.Option{mail.WithTimeout(smtpDialTimeout)}
-	if port == smtpImplicitTLSPort {
-		opts = append(opts, mail.WithSSLPort(false))
+	opts := []mail.Option{mail.WithPort(port), mail.WithTimeout(smtpDialTimeout)}
+	if m.cfg.tlsMode(port) == smtpTLSImplicit {
+		opts = append(opts, mail.WithSSL())
 	} else {
-		opts = append(opts, mail.WithPort(port), mail.WithTLSPortPolicy(mail.TLSMandatory))
+		opts = append(opts, mail.WithTLSPortPolicy(mail.TLSMandatory))
 	}
 	if m.cfg.Username != "" {
 		opts = append(opts,

backend/internal/account/mailer_test.go

@@ -0,0 +1,29 @@
+package account
+
+import "testing"
+
+// TestSMTPTLSMode covers the explicit TLS mode and the port-based fallback, including
+// the non-standard Selectel ports (1127 = SSL, 1126 = STARTTLS) that the 465 heuristic
+// alone cannot classify.
+func TestSMTPTLSMode(t *testing.T) {
+	cases := []struct {
+		name string
+		tls  string
+		port int
+		want string
+	}{
+		{"explicit ssl on a custom port (Selectel 1127)", "ssl", 1127, smtpTLSImplicit},
+		{"explicit starttls on a custom port (Selectel 1126)", "starttls", 1126, smtpTLSSTARTTLS},
+		{"tls is an alias for ssl", "TLS", 2525, smtpTLSImplicit},
+		{"empty derives implicit TLS on 465", "", 465, smtpTLSImplicit},
+		{"empty derives STARTTLS on 587", "", 587, smtpTLSSTARTTLS},
+		{"an unknown value falls back to the port heuristic", "bogus", 465, smtpTLSImplicit},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := (SMTPConfig{TLS: c.tls}).tlsMode(c.port); got != c.want {
+				t.Errorf("tlsMode(TLS=%q, port=%d) = %q, want %q", c.tls, c.port, got, c.want)
+			}
+		})
+	}
+}

backend/internal/config/config.go

@@ -148,6 +148,7 @@ func Load() (Config, error) {
 		Username: os.Getenv("BACKEND_SMTP_USERNAME"),
 		Password: os.Getenv("BACKEND_SMTP_PASSWORD"),
 		From:     envOr("BACKEND_SMTP_FROM", "no-reply@localhost"),
+		TLS:      os.Getenv("BACKEND_SMTP_TLS"),
 	}
 
 	c := Config{