feat: add --outgoing-ignore-tls to keep the relay off STARTTLS (#377)

The relay connection only had `secure`, so with `secure: false` nodemailer
still upgraded to STARTTLS whenever the server advertised it, and there was
no way to talk cleartext to such a server. Pass nodemailer's `ignoreTLS`
through as `ignoreTLS` on the relay config, wired to
--outgoing-ignore-tls / MAILDEV_OUTGOING_IGNORE_TLS / `outgoingIgnoreTls`.

packages/cli/README.md

@@ -59,6 +59,7 @@ Usage: maildev [options]
 | `--outgoing-user <user>`         | `MAILDEV_OUTGOING_USER`    | SMTP user for outgoing mail                                                               |
 | `--outgoing-pass <password>`     | `MAILDEV_OUTGOING_PASS`    | SMTP password for outgoing mail                                                           |
 | `--outgoing-secure`              | `MAILDEV_OUTGOING_SECURE`  | Use SMTP SSL for outgoing mail                                                            |
+| `--outgoing-ignore-tls`          | `MAILDEV_OUTGOING_IGNORE_TLS` | Never use STARTTLS for outgoing mail, even if the server offers it                        |
 | `--auto-relay [email]`           | `MAILDEV_AUTO_RELAY`       | Use auto-relay mode. Optional relay email address                                         |
 | `--auto-relay-rules <file>`      | `MAILDEV_AUTO_RELAY_RULES` | Filter rules for auto relay mode                                                          |
 | `--web-user <user>`              | `MAILDEV_WEB_USER`         | HTTP user for GUI                                                                         |
@@ -176,6 +177,9 @@ maildev --outgoing-host smtp.gmail.com \
         --outgoing-pass '<pass>'
 ```
 
+MailDev upgrades a non-secure relay connection with STARTTLS whenever the server offers it. Add
+`--outgoing-ignore-tls` to keep it on cleartext, e.g. for a relay on port 587 that does not support TLS.
+
 ### Auto Relay Mode
 
 Enabling the auto relay mode will automatically send each email to its recipient

packages/cli/src/__tests__/config/env.test.ts

@@ -87,6 +87,14 @@ describe('loadEnvConfig', () => {
     expect(config.outgoingPass).toBe('relay_pass')
   })
 
+  it('should parse MAILDEV_OUTGOING_IGNORE_TLS as boolean', () => {
+    process.env.MAILDEV_OUTGOING_IGNORE_TLS = 'true'
+    expect(loadEnvConfig().outgoingIgnoreTls).toBe(true)
+
+    process.env.MAILDEV_OUTGOING_IGNORE_TLS = 'false'
+    expect(loadEnvConfig().outgoingIgnoreTls).toBe(false)
+  })
+
   it('should load MAILDEV_MAIL_DIRECTORY', () => {
     process.env.MAILDEV_MAIL_DIRECTORY = '/var/mail'
 

packages/cli/src/__tests__/config/merge.test.ts

@@ -160,6 +160,7 @@ describe('resolveConfig', () => {
       outgoingUser: 'relay_user',
       outgoingPass: 'relay_pass',
       outgoingSecure: true,
+      outgoingIgnoreTls: true,
     })
 
     expect(config.outgoingHost).toBe('smtp.example.com')
@@ -167,6 +168,7 @@ describe('resolveConfig', () => {
     expect(config.outgoingUser).toBe('relay_user')
     expect(config.outgoingPass).toBe('relay_pass')
     expect(config.outgoingSecure).toBe(true)
+    expect(config.outgoingIgnoreTls).toBe(true)
   })
 
   it('should handle mail directory option', async () => {

packages/cli/src/config/env.ts

@@ -60,6 +60,7 @@ const NUMBER_VARS = new Set([
 const BOOLEAN_VARS = new Set([
   'MAILDEV_INCOMING_SECURE',
   'MAILDEV_OUTGOING_SECURE',
+  'MAILDEV_OUTGOING_IGNORE_TLS',
   'MAILDEV_HTTPS',
   'MAILDEV_DISABLE_WEB',
   'MAILDEV_MCP',
@@ -149,6 +150,7 @@ function envVarToConfigKey(envVar: string): keyof PartialMailDevConfig | null {
     verbose: 'verbose',
     silent: 'silent',
     mcp: 'mcp',
+    outgoingIgnoreTls: 'outgoingIgnoreTls',
   }
 
   return mapping[camelCase] || null

packages/cli/src/config/merge.ts

@@ -59,6 +59,7 @@ function cliOptionsToConfig(options: CLIOptions): PartialMailDevConfig {
   if (options.disableWeb !== undefined) config.disableWeb = options.disableWeb
   if (options.https !== undefined) config.https = options.https
   if (options.outgoingSecure !== undefined) config.outgoingSecure = options.outgoingSecure
+  if (options.outgoingIgnoreTls !== undefined) config.outgoingIgnoreTls = options.outgoingIgnoreTls
   if (options.verbose !== undefined) config.verbose = options.verbose
   if (options.silent !== undefined) config.silent = options.silent
   if (options.logMailContents !== undefined)

packages/cli/src/config/types.ts

@@ -225,6 +225,12 @@ export interface MailDevConfig {
    */
   outgoingSecure?: boolean
 
+  /**
+   * Never upgrade the outgoing relay connection with STARTTLS
+   * CLI: --outgoing-ignore-tls
+   */
+  outgoingIgnoreTls?: boolean
+
   /**
    * Enable auto-relay mode
    * CLI: --auto-relay [email]
@@ -330,6 +336,7 @@ export interface CLIOptions {
   outgoingUser?: string
   outgoingPass?: string
   outgoingSecure?: boolean
+  outgoingIgnoreTls?: boolean
   autoRelay?: boolean | string
   autoRelayRules?: string
   mailDirectory?: string

packages/cli/src/options.ts

@@ -113,6 +113,10 @@ export function configureOptions(program: Command): void {
       '--outgoing-secure',
       'Use TLS/SSL for outgoing relay'
     )
+    .option(
+      '--outgoing-ignore-tls',
+      'Never use STARTTLS for outgoing relay, even if the server offers it'
+    )
     .option(
       '--auto-relay [email]',
       'Enable auto-relay mode (optionally specify recipient email)'

packages/cli/src/server/orchestrator.ts

@@ -306,6 +306,9 @@ export class Orchestrator {
     if (this.config.outgoingSecure !== undefined) {
       config.secure = this.config.outgoingSecure
     }
+    if (this.config.outgoingIgnoreTls !== undefined) {
+      config.ignoreTLS = this.config.outgoingIgnoreTls
+    }
     if (this.config.outgoingUser && this.config.outgoingPass) {
       config.auth = {
         user: this.config.outgoingUser,