Enable IONOS SMTP mailer for Forgejo on railiance01

Wire forgejo@coulomb.social via smtp.ionos.com:587 in Helm values and add
SOPS-encrypted mailbox password overlay for forgejo-deploy.

docs/forgejo-on-railiance01.md

@@ -81,6 +81,49 @@ make forgejo-logs
 make forgejo-smoke
 ```
 
+## SMTP (IONOS) — password reset / notifications
+
+Decision: `the-custodian/docs/forgejo-production-decisions.md` (IONOS, 2026-07-07).
+
+Operator provisions a mailbox on `coulomb.social` in the IONOS control panel
+(e.g. `forgejo@coulomb.social`). Subdomains use the same IONOS SMTP relay; the
+`FROM` address must be a valid mailbox on the zone.
+
+Non-secret Helm values belong in `helm/forgejo-values.yaml` under
+`gitea.config.mailer` once ready to enable:
+
+```yaml
+gitea:
+  config:
+    mailer:
+      ENABLED: true
+      FROM: forgejo@coulomb.social
+      MAILER_TYPE: smtp
+      HOST: smtp.ionos.com:587   # or smtp.ionos.de:587 for EU accounts
+      IS_TLS_ENABLED: true
+      USER: forgejo@coulomb.social
+```
+
+Mailbox password goes in `helm/forgejo-secrets.sops.yaml` (encrypt from template):
+
+```yaml
+gitea:
+  config:
+    mailer:
+      PASSWD: <IONOS mailbox password>
+```
+
+Deploy path:
+
+```bash
+cd ~/railiance-apps
+make check-sops
+KUBECONFIG=~/.kube/config-hosteurope make forgejo-deploy
+# T06: Admin → user → Send reset password; confirm email delivery
+```
+
+Do not enable `mailer.ENABLED` until the SOPS secret is in place.
+
 ## Coexistence with Gitea
 
 Gitea on coulombcore remains canonical until `RAIL-HO-WP-0005` migration drills

helm/forgejo-secrets.sops.yaml

@@ -0,0 +1,28 @@
+gitea:
+    admin:
+        password: ENC[AES256_GCM,data:D4vjZzWdKb8FgCXcRp+Ndjya1yFqB995,iv:WzOzUMTu4TBcpEgYFkz186CnmSpmmQ+Jqnz8I4ZpVVw=,tag:hHbXEhBGfNhr63mNF/HTBA==,type:str]
+    config:
+        database:
+            PASSWD: ENC[AES256_GCM,data:oHp70axstRWh4YPYeKNpt8a8eejgFjyw6azdhZG1WqA=,iv:B9acXzEmJ2tGzkIkG2X/RsrdSGwzV/dgOI3Hn8/J9is=,tag:WHs/yEIZ7upffCXaOUfPuQ==,type:str]
+        mailer:
+            PASSWD: ENC[AES256_GCM,data:W3+t8Hgn4/yPAvVWYa/Gkn4=,iv:NrL0TD3lTQWfVIzxbjJi9FrZrMmI6s4Bpo8zvMKVHLI=,tag:pBvK4wrhOOWUDI2wtg7MIQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsbjJqRG9uOUZiU0RjSnVm
+            aE9ZaitSdjdjb0RNU2pzNGlsTHV5K2I1MGlBCms2RFRPelA1ODBoVTZidFZnOC9u
+            ZllVazZDRmZjQzg4L0E3QXpJWDFIUGcKLS0tIFViM0czZDR6dUFTRmZXRUQ0RW9w
+            aEF0RDMzb0o1YzduZHIxUGNBdVRnOGMKjDu/B39gqkT2JJ/7NGbFqmyUPtGAf3ST
+            sUNhOgGXQRs6576QSiUEzO8Prio/lnFPM96boMgXv4+Gt2dcPmXyoA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-07T00:41:12Z"
+    mac: ENC[AES256_GCM,data:8TM3EOv3yhYfh6QTTcD2AJK1y77JJKygwoJUMULN3q3A+b/RefpXs6+h66wn13P9EvQu9FTZg0kwijLUOCktuBPfaAiz00+BK9PFtt5UsDA9g/qUVA5EUxpmq0vRzDv1njhomwmI/f9pMbKiXRvXpkXxhpMeRx6XN0D4itCEMvI=,iv:RlicLXVU7kQgfc6bM2wAvyAB8zAMX3G8ZPeToJ73g14=,tag:Det/rkDaw8LqJNqZlkGKkw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

helm/forgejo-secrets.sops.yaml.template

@@ -1,5 +1,5 @@
 # Encrypt as helm/forgejo-secrets.sops.yaml before production deploy.
-# Contains database PASSWD and admin password consumed by the gitea chart.
+# Contains database PASSWD, admin password, and IONOS SMTP mailbox password.
 #
 # gitea:
 #   admin:
@@ -7,9 +7,13 @@
 #   config:
 #     database:
 #       PASSWD: <same as forgejo-db-credentials>
+#     mailer:
+#       PASSWD: <IONOS mailbox password for forgejo@coulomb.social>
 gitea:
   admin:
     password: REPLACE_WITH_ADMIN_PASSWORD
   config:
     database:
       PASSWD: REPLACE_WITH_DB_PASSWORD
+    mailer:
+      PASSWD: REPLACE_WITH_IONOS_MAILBOX_PASSWORD

helm/forgejo-values.yaml

@@ -49,5 +49,12 @@ gitea:
       DISABLE_SSH: false
     service:
       DISABLE_REGISTRATION: true
+    mailer:
+      ENABLED: true
+      FROM: forgejo@coulomb.social
+      MAILER_TYPE: smtp
+      HOST: smtp.ionos.com:587
+      IS_TLS_ENABLED: true
+      USER: forgejo@coulomb.social
     actions:
       ENABLED: true