Allow self signed cert for stalwart

src/pages/api/contact.ts

@@ -167,11 +167,20 @@ async function deliver(msg: Message): Promise<boolean> {
     const nodemailer = (await import('nodemailer')).default;
     const port = Number(smtpPort() ?? 587);
     const user = smtpUser();
+    // Accept self-signed certificates when explicitly opted in. Intended for
+    // internal homelab hops where the SMTP relay (e.g. Stalwart on the same
+    // Docker network) presents a self-signed cert and the connection never
+    // traverses an untrusted network. Defaults to false so production-grade
+    // TLS verification is the default; the override is a deliberate choice.
+    const allowSelfSigned = env('SMTP_ALLOW_SELFSIGNED') === 'true';
     const transport = nodemailer.createTransport({
       host,
       port,
       secure: port === 465,
       auth: user ? { user, pass: smtpPass() } : undefined,
+      ...(allowSelfSigned
+        ? { tls: { rejectUnauthorized: false } }
+        : {}),
     });
     const hostname = (() => {
       try {