# =========================================================================
# 代表的な外部メールプロバイダの設定例
# -------------------------------------------------------------------------
# 使い方:
#   helm upgrade --install secrets ./secret-manager \
#     -n secret-manager --create-namespace \
#     -f examples/mail-providers.values.yaml \
#     --set mail.providers.gmail.smtp.password="$GMAIL_APP_PASSWORD"
#
# パスワード等の実値はこのファイルに書かず、--set / SOPS 経由で注入すること。
# =========================================================================

distribution:
  namespaces:
    - default
    - web
    - batch
  includeReleaseNamespace: true

common:
  namePrefix: "cred-"
  immutable: false

mail:
  providers:

    # ---- Gmail / Google Workspace -----------------------------------------
    # 事前に「アプリ パスワード」を発行しておくこと（2段階認証必須）。
    gmail:
      enabled: true
      smtp:
        host: "smtp.gmail.com"
        port: 587
        security: "starttls"
        username: "no-reply@your-domain.com"
        password: "REPLACE_VIA_--set"
        from: "no-reply@your-domain.com"
        fromName: "Your Service"
        authMethod: "login"
      imap:
        host: "imap.gmail.com"
        port: 993
        security: "tls"
      renderMsmtprc: true      # 既定値なので本来は省略可

    # ---- Microsoft 365 / Exchange Online ---------------------------------
    m365:
      enabled: true
      smtp:
        host: "smtp.office365.com"
        port: 587
        security: "starttls"
        username: "no-reply@your-domain.com"
        password: "REPLACE_VIA_--set"
        from: "no-reply@your-domain.com"
        authMethod: "login"
      imap:
        host: "outlook.office365.com"
        port: 993
        security: "tls"
      renderMsmtprc: true      # 既定値なので本来は省略可

    # ---- SendGrid -------------------------------------------------------
    # username は固定文字列 "apikey"、password が API キー本体。
    sendgrid:
      enabled: true
      smtp:
        host: "smtp.sendgrid.net"
        port: 587
        security: "starttls"
        username: "apikey"
        password: "REPLACE_VIA_--set"
        from: "no-reply@your-domain.com"
        fromName: "Your Service"
        authMethod: "plain"
      renderMsmtprc: true      # 既定値なので本来は省略可

    # ---- Amazon SES ---------------------------------------------------
    # SES SMTP 認証情報（IAM のアクセスキーとは別物）を使う。リージョンをホスト名に反映。
    ses:
      enabled: true
      smtp:
        host: "email-smtp.ap-northeast-1.amazonaws.com"
        port: 587
        security: "starttls"
        username: "REPLACE_VIA_--set"
        password: "REPLACE_VIA_--set"
        from: "no-reply@your-domain.com"
        authMethod: "login"
      renderMsmtprc: true      # 既定値なので本来は省略可

    # ---- Mailgun -----------------------------------------------------
    mailgun:
      enabled: true
      smtp:
        host: "smtp.mailgun.org"
        port: 587
        security: "starttls"
        username: "postmaster@mg.your-domain.com"
        password: "REPLACE_VIA_--set"
        from: "no-reply@your-domain.com"
        authMethod: "plain"
      renderMsmtprc: true      # 既定値なので本来は省略可

    # ---- 汎用 / 社内 SMTP リレー（認証なし・TLSなし）--------------------
    internal-relay:
      enabled: false
      smtp:
        host: "mail-relay.svc.cluster.local"
        port: 25
        security: "none"
        from: "no-reply@your-domain.com"

    # ---- 社内 SMTP（自己署名証明書。STARTTLS だが証明書検証はしない）------
    internal-tls-relay:
      enabled: false
      smtp:
        host: "mail.internal.example"
        port: 587
        security: "starttls"
        username: "app"
        password: "REPLACE_VIA_--set"
        from: "no-reply@your-domain.com"
        tlsVerify: false       # 自己署名のため証明書検証を無効化（msmtprc に tls_certcheck off）