99882bb80a
Prevents the form being abused as an open email relay to arbitrary addresses (which is the realistic abuse vector — disk fill, server compromise, and device exploitation are all bounded already). Default allowlist: kindle.com, pbsync.com. Suffix matching so subdomains (e.g. free.kindle.com) are also accepted. Configurable via ALLOWED_READER_DOMAINS env var so the list can be extended without code changes.
16 lines
613 B
Text
16 lines
613 B
Text
PORT=3000
|
|
|
|
# SMTP — defaults are set for Resend.
|
|
# Port 587 (STARTTLS) is used instead of 465 (implicit TLS) because most VPS
|
|
# providers (Hetzner, DigitalOcean, etc.) block outbound 465 by default.
|
|
SMTP_HOST=smtp.resend.com
|
|
SMTP_PORT=587
|
|
SMTP_USER=resend
|
|
SMTP_PASSWORD=
|
|
MAIL_FROM=send@read.atanasov.fi
|
|
|
|
# Comma-separated list of allowed destination email domains. Anything that
|
|
# doesn't match (suffix-wise, so subdomains like free.kindle.com count) is
|
|
# rejected with a 400. This prevents the app from being abused as an open
|
|
# email relay to arbitrary addresses.
|
|
ALLOWED_READER_DOMAINS=kindle.com,pbsync.com
|