OpenSMTPD

Outbound mail relay for environments not using a hosted provider. Every site gets one; it listens inside the stack on port 25 and is what talks to the outside world, so an application only has to know where it is (SMTP_HOST — see Variables).

A Drupal site using settings.vallic.php is pointed at it already and needs nothing.

#Relaying through your own provider

Sending straight from a cloud address is the thing most likely to put your mail in a spam folder, whatever it says — the address has no reputation and often sits in a range that has. A production site that sends anything a customer needs to receive should relay through a provider that does have one: SendGrid, Mailgun, Postmark, Amazon SES, or whoever you already pay.

version: 1
type: drupal

services:
  - mariadb: '11.8'
  - opensmtpd:
      version: '7.8'
      environment:
        RELAY_HOST: smtp.sendgrid.net
        RELAY_PORT: '587'
        RELAY_USER: apikey

The password does not go here. Anything set on a service is written into the environment the platform renders, and that is stored where a task can be read from. Add RELAY_PASSWORD as a secret project variable instead: it is encrypted at rest, never shown again, and every container is given the whole environment — so the relay receives it without your manifest naming it.

That split is the general rule on this platform, not a quirk of mail: what is safe to read belongs in the repository, and what is not belongs in the console.

#Deliverability is still yours

The relay sends what it is given. Whether it arrives depends on SPF, DKIM and DMARC records on the domain you send from, and those live in your DNS. A provider will tell you which records it needs; nothing here can publish them for you, because it is your domain.

#Versions

A deprecated version still runs and is still what some sites are on. It is listed so you can move before it goes, rather than finding out on the morning a build stops resolving it.

Pin the version, not the build: name 7.8 and the platform matches it to the current build, so a security rebuild reaches you without anybody editing a repository.

#What you can change

In vallic.yaml — what each one does is on Service settings:

services:
  - opensmtpd:
      version: '7.8'
      environment:
        RELAY_HOST: …
        RELAY_PORT: …
        RELAY_PROTO: …
        RELAY_USER: …
        OPENSMTPD_MAX_MESSAGE_SIZE: …
        OPENSMTPD_EXPIRE: …
        OPENSMTPD_BOUNCE_WARN: …

Anything not on this list refuses the deploy, naming the variable — rather than being accepted and quietly ignored.