# Setting up outgoing email

Bid Sentinel can email a report to you with one click ("Email me this"). Reports
are sent **only to the email address of the logged-in user** — you can't send to
anyone else, so the app can't be used as a mail relay.

Email is **off until you configure SMTP**. The email buttons are hidden until
then, so nothing breaks if you don't use this feature.

---

## 1. Get SMTP details

Use any SMTP account:

- Your organisation's mail server, **Microsoft 365**, or **Google Workspace** SMTP, or
- a transactional provider (**SendGrid, Mailgun, Amazon SES, Postmark**) — recommended
  for reliable inbox delivery.

You'll need: host, port, username, password (or API key), and a "from" address.

## 2. Add the settings to `.env`

In the project root (next to `docker-compose.yml`), edit `.env`:

```
SMTP_HOST=smtp.yourprovider.com
SMTP_PORT=587
SMTP_USERNAME=your-username
SMTP_PASSWORD=your-password-or-api-key
SMTP_FROM=Bid Sentinel <no-reply@yourdomain.com>
SMTP_STARTTLS=true
```

- **Port 587** → STARTTLS (`SMTP_STARTTLS=true`) — the common choice.
- **Port 465** → implicit TLS (set `SMTP_PORT=465`; `SMTP_STARTTLS` is ignored).
- Leave `SMTP_HOST` **blank** to disable email entirely.

## 3. Restart

```bash
docker compose up -d --build
```

## 4. Use it

The email buttons appear automatically once SMTP is configured:

- **Dashboard** — “✉ Email CSV” / “✉ Email PDF” next to the export buttons (emails
  the current, filtered view).
- **Intelligence** — “✉ Email me” next to *Export PDF report* (respects the
  *AI angles* toggle).

Each email goes to the address you're logged in with. Sends are recorded in the
**Audit trail**.

---

## Troubleshooting

| Symptom | Fix |
|---|---|
| No email buttons appear | `SMTP_HOST` isn't set. Add it to `.env` and `docker compose up -d --build`. |
| "Could not send email" | Check host/port/credentials; try port 587 + STARTTLS, or 465 + implicit TLS. Some providers require an **app password** rather than your login password. |
| Emails land in spam | Set up **SPF/DKIM** for your sending domain, or use a transactional provider that handles it. |
| Verify quickly | `curl http://localhost:8080/api/email/status` → `{"available":true}` when SMTP is configured. |

## Notes
- SMTP credentials are secrets — keep `.env` out of version control (already in `.gitignore`).
- Recipient is always the logged-in user's own address; there is no field to send elsewhere.
- Attachments are capped at 15 MB.
