From 3097073f86502a3d0fe36050012cf07e5ff54b59 Mon Sep 17 00:00:00 2001
From: Nils Pukropp <nils@narl.io>
Date: Tue, 17 Feb 2026 23:08:09 +0100
Subject: [PATCH] added insecure email backend for self signed certs

---
 .env.example                     | 15 ++++++++++-----
 backend/api/email_backend.py     | 18 ++++++++++++++++++
 backend/holy_backend/settings.py |  3 ++-
 3 files changed, 30 insertions(+), 6 deletions(-)
 create mode 100644 backend/api/email_backend.py

diff --git a/.env.example b/.env.example
index e7f22d3..e6a8dd7 100644
--- a/.env.example
+++ b/.env.example
@@ -20,11 +20,16 @@ CORS_ALLOWED_ORIGINS=https://holy.narl.io
 
 # --- SMTP Configuration (Required for Email Verification) ---
 # For development, if EMAIL_HOST is empty, emails are printed to the console.
-EMAIL_HOST=smtp.gmail.com
-EMAIL_PORT=465
-EMAIL_USE_SSL=true
-EMAIL_HOST_USER="your-email@gmail.com"
-EMAIL_HOST_PASSWORD="your-app-specific-password"
+EMAIL_HOST=localhost
+EMAIL_PORT=587
+# Use EMAIL_USE_TLS=true for STARTTLS (usually port 587)
+EMAIL_USE_TLS=true
+# Use EMAIL_USE_SSL=true for implicit SSL (usually port 465)
+EMAIL_USE_SSL=false
+EMAIL_HOST_USER="your-email@example.com"
+EMAIL_HOST_PASSWORD="your-password"
+# Set to 'true' if using a self-signed certificate (e.g. local SMTP server)
+EMAIL_SKIP_CERT_VERIFICATION=false
 
 # --- Frontend Configuration ---
 # The base URL of the backend API (MUST end with /api/)
diff --git a/backend/api/email_backend.py b/backend/api/email_backend.py
new file mode 100644
index 0000000..24762a9
--- /dev/null
+++ b/backend/api/email_backend.py
@@ -0,0 +1,18 @@
+import ssl
+from django.core.mail.backends.smtp import EmailBackend
+from django.conf import settings
+
+class InsecureEmailBackend(EmailBackend):
+    """
+    SMTP email backend that allows skipping SSL certificate verification.
+    Useful for local development or internal SMTP servers with self-signed certificates.
+    Set EMAIL_SKIP_CERT_VERIFICATION = True in settings to use.
+    """
+    @property
+    def ssl_context(self):
+        if getattr(settings, 'EMAIL_SKIP_CERT_VERIFICATION', False):
+            context = ssl.create_default_context()
+            context.check_hostname = False
+            context.verify_mode = ssl.CERT_NONE
+            return context
+        return super().ssl_context
diff --git a/backend/holy_backend/settings.py b/backend/holy_backend/settings.py
index 3ed1303..289b684 100644
--- a/backend/holy_backend/settings.py
+++ b/backend/holy_backend/settings.py
@@ -205,9 +205,10 @@ EMAIL_USE_TLS = os.environ.get('EMAIL_USE_TLS', 'false').lower() == 'true'
 EMAIL_USE_SSL = os.environ.get('EMAIL_USE_SSL', 'false').lower() == 'true'
 EMAIL_HOST_USER = os.environ.get('EMAIL_HOST_USER')
 EMAIL_HOST_PASSWORD = os.environ.get('EMAIL_HOST_PASSWORD')
+EMAIL_SKIP_CERT_VERIFICATION = os.environ.get('EMAIL_SKIP_CERT_VERIFICATION', 'false').lower() == 'true'
 
 if EMAIL_HOST:
-    EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
+    EMAIL_BACKEND = 'api.email_backend.InsecureEmailBackend'
 else:
     EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'